You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by va...@apache.org on 2025/07/29 12:45:44 UTC
(qpid-broker-j) branch main updated: QPID-8701: [Broker-J] Remove deprecated authentication providers (#300)
This is an automated email from the ASF dual-hosted git repository.
vavrtom pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/qpid-broker-j.git
The following commit(s) were added to refs/heads/main by this push:
new af45a37490 QPID-8701: [Broker-J] Remove deprecated authentication providers (#300)
af45a37490 is described below
commit af45a374900db5c760cd4945d8ab00649a7bcdb8
Author: Daniil Kirilyuk <da...@gmail.com>
AuthorDate: Tue Jul 29 14:45:40 2025 +0200
QPID-8701: [Broker-J] Remove deprecated authentication providers (#300)
* QPID-8701 - [Broker-J] Remove deprecated authentication providers
* Removed extra space
---------
Co-authored-by: vavrtom <va...@apache.org>
---
.../AbstractPasswordFilePrincipalDatabase.java | 431 -------------------
.../Base64MD5PasswordFilePrincipalDatabase.java | 155 -------
.../server/security/auth/database/HashedUser.java | 208 ---------
.../security/auth/database/PasswordPrincipal.java | 41 --
.../PlainPasswordFilePrincipalDatabase.java | 157 -------
.../server/security/auth/database/PlainUser.java | 125 ------
.../security/auth/database/PrincipalDatabase.java | 116 -----
...64MD5PasswordDatabaseAuthenticationManager.java | 50 ---
...PlainPasswordDatabaseAuthenticationManager.java | 47 --
.../PrincipalDatabaseAuthenticationManager.java | 475 ---------------------
.../AbstractPasswordFilePrincipalDatabaseTest.java | 147 -------
...Base64MD5PasswordFilePrincipalDatabaseTest.java | 330 --------------
.../security/auth/database/HashedUserTest.java | 81 ----
.../PlainPasswordFilePrincipalDatabaseTest.java | 299 -------------
.../security/auth/database/PlainUserTest.java | 81 ----
...nPasswordDatabaseAuthenticationManagerTest.java | 217 ----------
...sswordFileAuthenticationManagerFactoryTest.java | 107 -----
...PrincipalDatabaseAuthenticationManagerTest.java | 303 -------------
.../auth/sasl/crammd5/CramMd5NegotiatorTest.java | 46 +-
.../base64md5passwordfile/add.js | 44 --
.../base64md5passwordfile/show.js | 35 --
.../plainpasswordfile/add.js | 45 --
.../plainpasswordfile/show.js | 35 --
.../docbkx/Java-Broker-Initial-Configuration.xml | 3 +-
...anagement-Managing-Authentication-Providers.xml | 4 -
...hentication-Providers-Base64MD5PasswordFile.xml | 42 --
...roker-Security-Authentication-Providers-MD5.xml | 7 +-
...ty-Authentication-Providers-MD5PasswordFile.xml | 41 --
...ker-Security-Authentication-Providers-Plain.xml | 3 +-
...-Authentication-Providers-PlainPasswordFile.xml | 45 --
...va-Broker-Security-Authentication-Providers.xml | 2 -
...va-Broker-Security-Configuration-Encryption.xml | 5 -
32 files changed, 48 insertions(+), 3679 deletions(-)
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabase.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabase.java
deleted file mode 100644
index a9dc86e2a6..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabase.java
+++ /dev/null
@@ -1,431 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.FileReader;
-import java.io.IOException;
-import java.io.PrintStream;
-import java.security.Principal;
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.regex.Pattern;
-
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.slf4j.Logger;
-
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.server.security.auth.sasl.PasswordSource;
-import org.apache.qpid.server.util.FileHelper;
-
-public abstract class AbstractPasswordFilePrincipalDatabase<U extends PasswordPrincipal> implements PrincipalDatabase
-{
- protected static final String DEFAULT_ENCODING = "utf-8";
-
- private final Pattern _regexp = Pattern.compile(":");
- private final Map<String, U> _userMap = new HashMap<>();
- private final ReentrantLock _userUpdate = new ReentrantLock();
- private final FileHelper _fileHelper = new FileHelper();
- private final PasswordCredentialManagingAuthenticationProvider<?> _authenticationProvider;
- private File _passwordFile;
-
- public AbstractPasswordFilePrincipalDatabase(PasswordCredentialManagingAuthenticationProvider<?> authenticationProvider)
- {
- _authenticationProvider = authenticationProvider;
- }
-
- @Override
- public final PasswordCredentialManagingAuthenticationProvider<?> getAuthenticationProvider()
- {
- return _authenticationProvider;
- }
-
- @Override
- public final void open(File passwordFile) throws IOException
- {
- getLogger().debug("PasswordFile using file : {}", passwordFile.getAbsolutePath());
- _passwordFile = passwordFile;
- if (!passwordFile.exists())
- {
- throw new FileNotFoundException("Cannot find password file " + passwordFile);
- }
- if (!passwordFile.canRead())
- {
- throw new FileNotFoundException("Cannot read password file " + passwordFile + ". Check permissions.");
- }
-
- loadPasswordFile();
- }
-
- /**
- * SASL Callback Mechanism - sets the Password in the PasswordCallback based on the value in the PasswordFile
- * If you want to change the password for a user, use updatePassword instead.
- *
- * @param principal The Principal to set the password for
- * @param callback The PasswordCallback to call setPassword on
- *
- * @throws javax.security.auth.login.AccountNotFoundException If the Principal cannot be found in this Database
- */
- @Override
- public final void setPassword(Principal principal, PasswordCallback callback) throws AccountNotFoundException
- {
- if (_passwordFile == null)
- {
- throw new AccountNotFoundException("Unable to locate principal since no password file was specified during initialisation");
- }
- if (principal == null)
- {
- throw new IllegalArgumentException("principal must not be null");
- }
- char[] pwd = lookupPassword(principal.getName());
-
- if (pwd != null)
- {
- callback.setPassword(pwd);
- }
- else
- {
- throw new AccountNotFoundException("No account found for principal " + principal);
- }
- }
-
-
- /**
- * Looks up the password for a specified user in the password file.
- *
- * @param name The principal name to lookup
- *
- * @return a char[] for use in SASL.
- */
- protected final char[] lookupPassword(String name)
- {
- U user = _userMap.get(name);
- if (user == null)
- {
- return null;
- }
- else
- {
- return user.getPassword();
- }
- }
-
- protected boolean compareCharArray(char[] a, char[] b)
- {
- boolean equal = false;
- if (a.length == b.length)
- {
- equal = true;
- int index = 0;
- while (equal && index < a.length)
- {
- equal = a[index] == b[index];
- index++;
- }
- }
- return equal;
- }
-
- /**
- * Changes the password for the specified user
- *
- * @param principal to change the password for
- * @param password plaintext password to set the password too
- */
- @Override
- public boolean updatePassword(Principal principal, char[] password) throws AccountNotFoundException
- {
- U user = _userMap.get(principal.getName());
-
- if (user == null)
- {
- throw new AccountNotFoundException(principal.getName());
- }
- for (char c : password)
- {
- if (c == ':')
- {
- throw new IllegalArgumentException("Illegal character in password");
- }
- }
-
- char[] orig = user.getPassword();
- _userUpdate.lock();
- try
- {
- user.setPassword(password);
-
- savePasswordFile();
-
- return true;
- }
- catch (IOException e)
- {
- getLogger().error("Unable to save password file due to '{}', password change for user '{}' discarded",
- e.getMessage(), principal);
- //revert the password change
- user.restorePassword(orig);
-
- return false;
- }
- finally
- {
- _userUpdate.unlock();
- }
- }
-
- protected PasswordSource getPasswordSource()
- {
- return this::lookupPassword;
- }
-
- private void loadPasswordFile() throws IOException
- {
- try
- {
- _userUpdate.lock();
- final Map<String, U> newUserMap = new HashMap<>();
-
- try(BufferedReader reader = new BufferedReader(new FileReader(_passwordFile)))
- {
- String line;
-
- while ((line = reader.readLine()) != null)
- {
- String[] result = _regexp.split(line);
- if (result == null || result.length < 2 || result[0].startsWith("#"))
- {
- continue;
- }
-
- U user = createUserFromFileData(result);
- newUserMap.put(user.getName(), user);
- }
- }
-
- getLogger().debug("Loaded {} user(s) from {}", newUserMap.size(), _passwordFile);
-
- _userMap.clear();
- _userMap.putAll(newUserMap);
- }
- finally
- {
- _userUpdate.unlock();
- }
- }
-
- protected abstract U createUserFromFileData(String[] result);
-
-
- protected abstract Logger getLogger();
-
-
- protected void savePasswordFile() throws IOException
- {
- try
- {
- _userUpdate.lock();
-
- _fileHelper.writeFileSafely(_passwordFile.toPath(), this::writeToFile);
- }
- finally
- {
- _userUpdate.unlock();
- }
- }
-
- private void writeToFile(File tmp) throws IOException
- {
- try(PrintStream writer = new PrintStream(tmp);
- BufferedReader reader = new BufferedReader(new FileReader(_passwordFile)))
- {
- String line;
-
- while ((line = reader.readLine()) != null)
- {
- String[] result = _regexp.split(line);
- if (result == null || result.length < 2 || result[0].startsWith("#"))
- {
- writer.write(line.getBytes(DEFAULT_ENCODING));
- writer.println();
- continue;
- }
-
- U user = _userMap.get(result[0]);
-
- if (user == null)
- {
- writer.write(line.getBytes(DEFAULT_ENCODING));
- writer.println();
- }
- else if (!user.isDeleted())
- {
- if (!user.isModified())
- {
- writer.write(line.getBytes(DEFAULT_ENCODING));
- writer.println();
- }
- else
- {
- byte[] encodedPassword = user.getEncodedPassword();
-
- writer.write((user.getName() + ":").getBytes(DEFAULT_ENCODING));
- writer.write(encodedPassword);
- writer.println();
-
- user.saved();
- }
- }
- }
-
- for (U user : _userMap.values())
- {
- if (user.isModified())
- {
- byte[] encodedPassword;
- encodedPassword = user.getEncodedPassword();
- writer.write((user.getName() + ":").getBytes(DEFAULT_ENCODING));
- writer.write(encodedPassword);
- writer.println();
- user.saved();
- }
- }
- }
- catch(IOException e)
- {
- getLogger().error("Unable to create the new password file", e);
- throw new IOException("Unable to create the new password file",e);
- }
- }
-
- protected abstract U createUserFromPassword(Principal principal, char[] passwd);
-
-
- @Override
- public void reload() throws IOException
- {
- loadPasswordFile();
- }
-
- @Override
- public List<Principal> getUsers()
- {
- return new LinkedList<>(_userMap.values());
- }
-
- @Override
- public Principal getUser(String username)
- {
- if (_userMap.containsKey(username))
- {
- return new UsernamePrincipal(username, getAuthenticationProvider());
- }
- return null;
- }
-
- @Override
- public boolean deletePrincipal(Principal principal) throws AccountNotFoundException
- {
- U user = _userMap.get(principal.getName());
-
- if (user == null)
- {
- throw new AccountNotFoundException(principal.getName());
- }
-
- try
- {
- _userUpdate.lock();
- user.delete();
-
- try
- {
- savePasswordFile();
- }
- catch (IOException e)
- {
- getLogger().error("Unable to remove user '{}' from password file.", user.getName());
- return false;
- }
-
- _userMap.remove(user.getName());
- }
- finally
- {
- _userUpdate.unlock();
- }
-
- return true;
- }
-
- @Override
- public boolean createPrincipal(Principal principal, char[] password)
- {
- if (_userMap.get(principal.getName()) != null)
- {
- return false;
- }
- if (principal.getName().contains(":"))
- {
- throw new IllegalArgumentException("Username must not contain colons (\":\").");
- }
- for (char c : password)
- {
- if (c == ':')
- {
- throw new IllegalArgumentException("Illegal character in password");
- }
- }
-
- U user = createUserFromPassword(principal, password);
-
-
- try
- {
- _userUpdate.lock();
- _userMap.put(user.getName(), user);
-
- try
- {
- savePasswordFile();
- return true;
- }
- catch (IOException e)
- {
- //remove the use on failure.
- _userMap.remove(user.getName());
- return false;
- }
- }
- finally
- {
- _userUpdate.unlock();
- }
- }
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabase.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabase.java
deleted file mode 100644
index 741dd291b4..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabase.java
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.security.Principal;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.sasl.SaslNegotiator;
-import org.apache.qpid.server.security.auth.sasl.SaslSettings;
-import org.apache.qpid.server.security.auth.sasl.crammd5.CramMd5HashedNegotiator;
-import org.apache.qpid.server.security.auth.sasl.crammd5.CramMd5HexNegotiator;
-import org.apache.qpid.server.security.auth.sasl.plain.PlainNegotiator;
-
-/**
- * Represents a user database where the account information is stored in a simple flat file.
- *
- * The file is expected to be in the form: username:password username1:password1 ... usernamen:passwordn
- *
- * where a carriage return separates each username/password pair. Passwords are assumed to be in plain text.
- */
-public class Base64MD5PasswordFilePrincipalDatabase extends AbstractPasswordFilePrincipalDatabase<HashedUser>
-{
- private static final Logger LOGGER = LoggerFactory.getLogger(Base64MD5PasswordFilePrincipalDatabase.class);
- private final List<String> _mechanisms = Collections.unmodifiableList(Arrays.asList(CramMd5HashedNegotiator.MECHANISM,
- CramMd5HexNegotiator.MECHANISM,
- PlainNegotiator.MECHANISM));
-
- public Base64MD5PasswordFilePrincipalDatabase(final PasswordCredentialManagingAuthenticationProvider<?> authenticationProvider)
- {
- super(authenticationProvider);
- }
-
- /**
- * Used to verify that the presented Password is correct. Currently only used by Management Console
- *
- * @param principal The principal to authenticate
- * @param password The password to check
- *
- * @return true if password is correct
- *
- * @throws AccountNotFoundException if the principal cannot be found
- */
- @Override
- public boolean verifyPassword(String principal, char[] password) throws AccountNotFoundException
- {
- char[] pwd = lookupPassword(principal);
-
- if (pwd == null)
- {
- throw new AccountNotFoundException("Unable to lookup the specified users password");
- }
-
- byte[] byteArray = new byte[password.length];
- int index = 0;
- for (char c : password)
- {
- byteArray[index++] = (byte) c;
- }
-
- byte[] md5byteArray;
- try
- {
- md5byteArray = HashedUser.getMD5(byteArray);
- }
- catch (Exception e1)
- {
- getLogger().warn("Unable to hash password for user '{}' for comparison", principal);
- return false;
- }
-
- char[] hashedPassword = new char[md5byteArray.length];
-
- index = 0;
- for (byte c : md5byteArray)
- {
- hashedPassword[index++] = (char) c;
- }
-
- return compareCharArray(pwd, hashedPassword);
- }
-
- @Override
- protected HashedUser createUserFromPassword(Principal principal, char[] passwd)
- {
- return new HashedUser(principal.getName(), passwd, getAuthenticationProvider());
- }
-
-
- @Override
- protected HashedUser createUserFromFileData(String[] result)
- {
- return new HashedUser(result, getAuthenticationProvider());
- }
-
- @Override
- protected Logger getLogger()
- {
- return LOGGER;
- }
-
- @Override
- public List<String> getMechanisms()
- {
- return _mechanisms;
- }
-
- @Override
- public SaslNegotiator createSaslNegotiator(final String mechanism, final SaslSettings saslSettings)
- {
- if(CramMd5HashedNegotiator.MECHANISM.equals(mechanism))
- {
- return new CramMd5HashedNegotiator(getAuthenticationProvider(),
- saslSettings.getLocalFQDN(),
- getPasswordSource());
- }
- else if(CramMd5HexNegotiator.MECHANISM.equals(mechanism))
- {
- return new CramMd5HexNegotiator(getAuthenticationProvider(),
- saslSettings.getLocalFQDN(),
- getPasswordSource());
- }
- else if(PlainNegotiator.MECHANISM.equals(mechanism))
- {
- return new PlainNegotiator(getAuthenticationProvider());
- }
- return null;
- }
-
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/HashedUser.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/HashedUser.java
deleted file mode 100644
index 61b99e82bb..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/HashedUser.java
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
-*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.io.UnsupportedEncodingException;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.util.Base64;
-
-import org.apache.qpid.server.model.AuthenticationProvider;
-import org.apache.qpid.server.util.ServerScopedRuntimeException;
-import org.apache.qpid.server.util.Strings;
-
-
-public class HashedUser implements PasswordPrincipal
-{
- private static final long serialVersionUID = 1L;
-
- private final AuthenticationProvider<?> _authenticationProvider;
- private final String _name;
- private char[] _password;
- private byte[] _encodedPassword = null;
- private boolean _modified = false;
- private boolean _deleted = false;
-
- HashedUser(String[] data, AuthenticationProvider<?> authenticationProvider)
- {
- if (data.length != 2)
- {
- throw new IllegalArgumentException("User Data should be length 2, username, password");
- }
-
- _name = data[0];
-
- byte[] encodedPassword;
- try
- {
- encodedPassword = data[1].getBytes(Base64MD5PasswordFilePrincipalDatabase.DEFAULT_ENCODING);
- }
- catch (UnsupportedEncodingException e)
- {
- throw new ServerScopedRuntimeException("MD5 encoding not supported, even though the Java standard requires it",e);
- }
-
- _encodedPassword = encodedPassword;
- byte[] decoded = Strings.decodeBase64(data[1]);
- _password = new char[decoded.length];
-
- int index = 0;
- for (byte c : decoded)
- {
- _password[index++] = (char) c;
- }
- _authenticationProvider = authenticationProvider;
- }
-
- public HashedUser(String name, char[] password, final AuthenticationProvider<?> authenticationProvider)
- {
- _name = name;
- _authenticationProvider = authenticationProvider;
- setPassword(password,false);
- }
-
- public static byte[] getMD5(byte[] data)
- {
- MessageDigest md = null;
- try
- {
- md = MessageDigest.getInstance("MD5");
- }
- catch (NoSuchAlgorithmException e)
- {
- throw new ServerScopedRuntimeException("MD5 not supported although Java compliance requires it");
- }
-
- for (byte b : data)
- {
- md.update(b);
- }
-
- return md.digest();
- }
-
- @Override
- public String getName()
- {
- return _name;
- }
-
- @Override
- public String toString()
- {
- return _name;
- }
-
- @Override
- public char[] getPassword()
- {
- return _password;
- }
-
- @Override
- public void setPassword(char[] password)
- {
- setPassword(password, false);
- }
-
- @Override
- public void restorePassword(char[] password)
- {
- setPassword(password, true);
- }
-
- void setPassword(char[] password, boolean alreadyHashed)
- {
- if(alreadyHashed)
- {
- _password = password;
- }
- else
- {
- byte[] byteArray = new byte[password.length];
- int index = 0;
- for (char c : password)
- {
- byteArray[index++] = (byte) c;
- }
-
- byte[] md5ByteArray = getMD5(byteArray);
-
- _password = new char[md5ByteArray.length];
-
- index = 0;
- for (byte c : md5ByteArray)
- {
- _password[index++] = (char) c;
- }
- }
-
- _modified = true;
- _encodedPassword = null;
- }
-
- @Override
- public byte[] getEncodedPassword()
- {
- if (_encodedPassword == null)
- {
- encodePassword();
- }
- return _encodedPassword;
- }
-
- private void encodePassword()
- {
- byte[] byteArray = new byte[_password.length];
- int index = 0;
- for (char c : _password)
- {
- byteArray[index++] = (byte) c;
- }
- _encodedPassword = Base64.getEncoder().encodeToString(byteArray).getBytes(StandardCharsets.UTF_8);
- }
-
- @Override
- public boolean isModified()
- {
- return _modified;
- }
-
- @Override
- public boolean isDeleted()
- {
- return _deleted;
- }
-
- @Override
- public void delete()
- {
- _deleted = true;
- }
-
- @Override
- public void saved()
- {
- _modified = false;
- }
-
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PasswordPrincipal.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PasswordPrincipal.java
deleted file mode 100644
index cdcbb53803..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PasswordPrincipal.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.io.Serializable;
-import java.security.Principal;
-
-interface PasswordPrincipal extends Principal, Serializable
-{
- char[] getPassword();
- byte[] getEncodedPassword();
-
- void setPassword(char[] password);
- void restorePassword(char[] password);
-
- boolean isDeleted();
-
- boolean isModified();
-
- void saved();
-
- void delete();
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java
deleted file mode 100644
index c31a2e38de..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.security.Principal;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.manager.AbstractScramAuthenticationManager;
-import org.apache.qpid.server.security.auth.manager.ScramSHA1AuthenticationManager;
-import org.apache.qpid.server.security.auth.manager.ScramSHA256AuthenticationManager;
-import org.apache.qpid.server.security.auth.sasl.PasswordSource;
-import org.apache.qpid.server.security.auth.sasl.SaslNegotiator;
-import org.apache.qpid.server.security.auth.sasl.SaslSettings;
-import org.apache.qpid.server.security.auth.sasl.crammd5.CramMd5Negotiator;
-import org.apache.qpid.server.security.auth.sasl.plain.PlainNegotiator;
-import org.apache.qpid.server.security.auth.sasl.scram.ScramNegotiator;
-import org.apache.qpid.server.security.auth.sasl.scram.ScramSaslServerSourceAdapter;
-
-/**
- * Represents a user database where the account information is stored in a simple flat file.
- *
- * The file is expected to be in the form: username:password username1:password1 ... usernamen:passwordn
- *
- * where a carriage return separates each username/password pair. Passwords are assumed to be in plain text.
- */
-public class PlainPasswordFilePrincipalDatabase extends AbstractPasswordFilePrincipalDatabase<PlainUser>
-{
-
- private static final Logger LOGGER = LoggerFactory.getLogger(PlainPasswordFilePrincipalDatabase.class);
- private final List<String> _mechanisms = Collections.unmodifiableList(Arrays.asList(PlainNegotiator.MECHANISM,
- CramMd5Negotiator.MECHANISM,
- ScramSHA1AuthenticationManager.MECHANISM,
- ScramSHA256AuthenticationManager.MECHANISM));
- private final ScramSaslServerSourceAdapter _scramSha1Adapter;
- private final ScramSaslServerSourceAdapter _scramSha256Adapter;
-
-
- public PlainPasswordFilePrincipalDatabase(PasswordCredentialManagingAuthenticationProvider<?> authenticationProvider)
- {
- super(authenticationProvider);
-
- PasswordSource passwordSource = getPasswordSource();
- final int scramIterationCount = authenticationProvider.getContextValue(Integer.class,
- AbstractScramAuthenticationManager.QPID_AUTHMANAGER_SCRAM_ITERATION_COUNT);
- _scramSha1Adapter = new ScramSaslServerSourceAdapter(scramIterationCount,
- ScramSHA1AuthenticationManager.HMAC_NAME,
- ScramSHA1AuthenticationManager.DIGEST_NAME,
- passwordSource);
- _scramSha256Adapter = new ScramSaslServerSourceAdapter(scramIterationCount,
- ScramSHA256AuthenticationManager.HMAC_NAME,
- ScramSHA256AuthenticationManager.DIGEST_NAME,
- passwordSource);
- }
-
-
- /**
- * Used to verify that the presented Password is correct. Currently only used by Management Console
- *
- * @param principal The principal to authenticate
- * @param password The plaintext password to check
- *
- * @return true if password is correct
- *
- * @throws AccountNotFoundException if the principal cannot be found
- */
- @Override
- public boolean verifyPassword(String principal, char[] password) throws AccountNotFoundException
- {
-
- char[] pwd = lookupPassword(principal);
-
- if (pwd == null)
- {
- throw new AccountNotFoundException("Unable to lookup the specified users password");
- }
-
- return compareCharArray(pwd, password);
-
- }
-
- @Override
- protected PlainUser createUserFromPassword(Principal principal, char[] passwd)
- {
- return new PlainUser(principal.getName(), passwd, getAuthenticationProvider());
- }
-
-
- @Override
- protected PlainUser createUserFromFileData(String[] result)
- {
- return new PlainUser(result, getAuthenticationProvider());
- }
-
-
- @Override
- protected Logger getLogger()
- {
- return LOGGER;
- }
-
-
- @Override
- public List<String> getMechanisms()
- {
- return _mechanisms;
- }
-
- @Override
- public SaslNegotiator createSaslNegotiator(final String mechanism, final SaslSettings saslSettings)
- {
- if (CramMd5Negotiator.MECHANISM.equals(mechanism))
- {
- return new CramMd5Negotiator(getAuthenticationProvider(),
- saslSettings.getLocalFQDN(),
- getPasswordSource());
- }
- else if (PlainNegotiator.MECHANISM.equals(mechanism))
- {
- return new PlainNegotiator(getAuthenticationProvider());
- }
- else if (ScramSHA1AuthenticationManager.MECHANISM.equals(mechanism))
- {
- return new ScramNegotiator(getAuthenticationProvider(), _scramSha1Adapter, ScramSHA1AuthenticationManager.MECHANISM);
- }
- else if (ScramSHA256AuthenticationManager.MECHANISM.equals(mechanism))
- {
- return new ScramNegotiator(getAuthenticationProvider(), _scramSha256Adapter, ScramSHA256AuthenticationManager.MECHANISM);
- }
- return null;
- }
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java
deleted file mode 100644
index 59048ff517..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
-*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import org.apache.qpid.server.model.AuthenticationProvider;
-
-public class PlainUser implements PasswordPrincipal
-{
- private static final long serialVersionUID = 1L;
-
- private final AuthenticationProvider<?> _authenticationProvider;
- private final String _name;
- private char[] _password;
- private boolean _modified = false;
- private boolean _deleted = false;
-
- PlainUser(String[] data, final AuthenticationProvider<?> authenticationProvider)
- {
- if (data.length != 2)
- {
- throw new IllegalArgumentException("User Data should be length 2, username, password");
- }
-
- _name = data[0];
-
- _password = data[1].toCharArray();
- _authenticationProvider = authenticationProvider;
- }
-
- public PlainUser(String name, char[] password, final AuthenticationProvider<?> authenticationProvider)
- {
- _name = name;
- _password = password;
- _authenticationProvider = authenticationProvider;
- _modified = true;
- }
-
- @Override
- public String getName()
- {
- return _name;
- }
-
- @Override
- public String toString()
- {
- return _name;
- }
-
- @Override
- public char[] getPassword()
- {
- return _password;
- }
-
- @Override
- public byte[] getEncodedPassword()
- {
- byte[] byteArray = new byte[_password.length];
- int index = 0;
- for (char c : _password)
- {
- byteArray[index++] = (byte) c;
- }
- return byteArray;
- }
-
-
-
- @Override
- public void restorePassword(char[] password)
- {
- setPassword(password);
- }
-
- @Override
- public void setPassword(char[] password)
- {
- _password = password;
- _modified = true;
- }
-
- @Override
- public boolean isModified()
- {
- return _modified;
- }
-
- @Override
- public boolean isDeleted()
- {
- return _deleted;
- }
-
- @Override
- public void delete()
- {
- _deleted = true;
- }
-
- @Override
- public void saved()
- {
- _modified = false;
- }
-
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PrincipalDatabase.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PrincipalDatabase.java
deleted file mode 100644
index e230f042a9..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/database/PrincipalDatabase.java
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import java.io.File;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.List;
-
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.sasl.SaslNegotiator;
-import org.apache.qpid.server.security.auth.sasl.SaslSettings;
-
-/** Represents a "user database" which is really a way of storing principals (i.e. usernames) and passwords. */
-public interface PrincipalDatabase
-{
- void open(File passwordFile) throws IOException;
-
- /**
- * Set the password for a given principal in the specified callback. This is used for certain SASL providers. The
- * user database implementation should look up the password in any way it chooses and set it in the callback by
- * calling its setPassword method.
- *
- * @param principal the principal
- * @param callback the password callback that wants to receive the password
- *
- * @throws AccountNotFoundException if the account for specified principal could not be found
- * @throws IOException if there was an error looking up the principal
- */
- void setPassword(Principal principal, PasswordCallback callback)
- throws IOException, AccountNotFoundException;
-
- /**
- * Used to verify that the presented Password is correct. Currently only used by Management Console
- * @param principal The principal to authenticate
- * @param password The password to check
- * @return true if password is correct
- * @throws AccountNotFoundException if the principal cannot be found
- */
- boolean verifyPassword(String principal, char[] password)
- throws AccountNotFoundException;
-
- /**
- * Update(Change) the password for the given principal
- * @param principal Who's password is to be changed
- * @param password The new password to use
- * @return True if change was successful
- * @throws AccountNotFoundException If the given principal doesn't exist in the Database
- */
- boolean updatePassword(Principal principal, char[] password)
- throws AccountNotFoundException;
-
- /**
- * Create a new principal in the database
- * @param principal The principal to create
- * @param password The password to set for the principal
- * @return True on a successful creation
- */
- boolean createPrincipal(Principal principal, char[] password);
-
- /**
- * Delete a principal
- * @param principal The principal to delete
- * @return True on a successful creation
- * @throws AccountNotFoundException If the given principal doesn't exist in the Database
- */
- boolean deletePrincipal(Principal principal)
- throws AccountNotFoundException;
-
- /**
- * Get the principal from the database with the given username
- * @param username of the principal to lookup
- * @return The Principal object for the given username or null if not found.
- */
- Principal getUser(String username);
-
- /**
- * Reload the database to its ensure contents are up to date
- * @throws IOException If there was an error reloading the database
- */
- void reload() throws IOException;
-
- List<Principal> getUsers();
-
- /**
- * Get the list of mechanisms supported for use with the PrincipalDatabase
- * @return space separated list of supported Sasl mechanisms
- */
- public List<String> getMechanisms();
-
- SaslNegotiator createSaslNegotiator(String mechanism, SaslSettings saslSettings);
-
- PasswordCredentialManagingAuthenticationProvider<?> getAuthenticationProvider();
-
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/Base64MD5PasswordDatabaseAuthenticationManager.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/Base64MD5PasswordDatabaseAuthenticationManager.java
deleted file mode 100644
index e021c98a70..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/Base64MD5PasswordDatabaseAuthenticationManager.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.manager;
-
-import java.util.Map;
-
-import org.apache.qpid.server.model.Broker;
-import org.apache.qpid.server.model.ManagedObject;
-import org.apache.qpid.server.model.ManagedObjectFactoryConstructor;
-import org.apache.qpid.server.security.auth.database.Base64MD5PasswordFilePrincipalDatabase;
-import org.apache.qpid.server.security.auth.database.PrincipalDatabase;
-
-@ManagedObject( category = false, managesChildren = true, type = "Base64MD5PasswordFile" )
-public class Base64MD5PasswordDatabaseAuthenticationManager
- extends PrincipalDatabaseAuthenticationManager<Base64MD5PasswordDatabaseAuthenticationManager>
-{
-
-
- public static final String PROVIDER_TYPE = "Base64MD5PasswordFile";
-
- @ManagedObjectFactoryConstructor
- protected Base64MD5PasswordDatabaseAuthenticationManager(final Map<String, Object> attributes, final Broker broker)
- {
- super(attributes, broker);
- }
-
- @Override
- protected PrincipalDatabase createDatabase()
- {
- return new Base64MD5PasswordFilePrincipalDatabase(this);
- }
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManager.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManager.java
deleted file mode 100644
index b4fd5ed38d..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManager.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.manager;
-
-import java.util.Map;
-
-import org.apache.qpid.server.model.Broker;
-import org.apache.qpid.server.model.ManagedObject;
-import org.apache.qpid.server.model.ManagedObjectFactoryConstructor;
-import org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase;
-import org.apache.qpid.server.security.auth.database.PrincipalDatabase;
-
-@ManagedObject( category = false, managesChildren = true, type = "PlainPasswordFile" )
-public class PlainPasswordDatabaseAuthenticationManager extends PrincipalDatabaseAuthenticationManager<PlainPasswordDatabaseAuthenticationManager>
-{
- public static final String PROVIDER_TYPE = "PlainPasswordFile";
-
- @ManagedObjectFactoryConstructor
- protected PlainPasswordDatabaseAuthenticationManager(final Map<String, Object> attributes, final Broker broker)
- {
- super(attributes, broker);
- }
-
- @Override
- protected PrincipalDatabase createDatabase()
- {
- return new PlainPasswordFilePrincipalDatabase(this);
- }
-}
diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManager.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManager.java
deleted file mode 100644
index 0e8da29f09..0000000000
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManager.java
+++ /dev/null
@@ -1,475 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- *
- */
-package org.apache.qpid.server.security.auth.manager;
-
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.security.Principal;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.apache.qpid.server.configuration.IllegalConfigurationException;
-import org.apache.qpid.server.model.AbstractConfiguredObject;
-import org.apache.qpid.server.model.ConfiguredObject;
-import org.apache.qpid.server.model.Container;
-import org.apache.qpid.server.model.ExternalFileBasedAuthenticationManager;
-import org.apache.qpid.server.model.ManagedAttributeField;
-import org.apache.qpid.server.model.NamedAddressSpace;
-import org.apache.qpid.server.model.State;
-import org.apache.qpid.server.model.StateTransition;
-import org.apache.qpid.server.model.SystemConfig;
-import org.apache.qpid.server.model.User;
-import org.apache.qpid.server.security.auth.AuthenticationResult;
-import org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus;
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.server.security.auth.database.PrincipalDatabase;
-import org.apache.qpid.server.security.auth.sasl.SaslNegotiator;
-import org.apache.qpid.server.security.auth.sasl.SaslSettings;
-import org.apache.qpid.server.util.FileHelper;
-
-public abstract class PrincipalDatabaseAuthenticationManager<T extends PrincipalDatabaseAuthenticationManager<T>>
- extends AbstractAuthenticationManager<T>
- implements ExternalFileBasedAuthenticationManager<T>
-{
-
- private static final Logger LOGGER = LoggerFactory.getLogger(PrincipalDatabaseAuthenticationManager.class);
-
-
- private final Map<Principal, PrincipalAdapter> _userMap = new ConcurrentHashMap<>();
-
- private PrincipalDatabase _principalDatabase;
- @ManagedAttributeField
- private String _path;
-
- protected PrincipalDatabaseAuthenticationManager(final Map<String, Object> attributes, final Container<?> broker)
- {
- super(attributes, broker);
- }
-
- @Override
- protected void validateOnCreate()
- {
- super.validateOnCreate();
- File passwordFile = new File(_path);
- if (passwordFile.exists() && !passwordFile.canRead())
- {
- throw new IllegalConfigurationException(String.format("Cannot read password file '%s'. Please check permissions.", _path));
- }
- }
-
- @Override
- protected void onCreate()
- {
- super.onCreate();
- File passwordFile = new File(_path);
- if (!passwordFile.exists())
- {
- try
- {
- Path path = new FileHelper().createNewFile(passwordFile, getContextValue(String.class, SystemConfig.POSIX_FILE_PERMISSIONS));
- if (!Files.exists(path))
- {
- throw new IllegalConfigurationException(String.format("Cannot create password file at '%s'", _path));
- }
- }
- catch (IOException e)
- {
- throw new IllegalConfigurationException(String.format("Cannot create password file at '%s'", _path), e);
- }
- }
- }
-
- @Override
- protected void onOpen()
- {
- super.onOpen();
- initialise();
- }
-
- @Override
- protected void postResolve()
- {
- super.postResolve();
- _principalDatabase = createDatabase();
- }
-
- protected abstract PrincipalDatabase createDatabase();
-
-
- @Override
- public String getPath()
- {
- return _path;
- }
-
- public void initialise()
- {
- try
- {
- _principalDatabase.open(new File(_path));
- }
- catch (FileNotFoundException e)
- {
- throw new IllegalConfigurationException("Exception opening password database: " + e.getMessage(), e);
- }
- catch (IOException e)
- {
- throw new IllegalConfigurationException("Cannot use password database at :" + _path, e);
- }
- }
-
- @Override
- public List<String> getMechanisms()
- {
- return _principalDatabase.getMechanisms();
- }
-
- @Override
- public SaslNegotiator createSaslNegotiator(final String mechanism,
- final SaslSettings saslSettings,
- final NamedAddressSpace addressSpace)
- {
- return _principalDatabase.createSaslNegotiator(mechanism, saslSettings);
- }
-
- /**
- * @see org.apache.qpid.server.security.auth.manager.UsernamePasswordAuthenticationProvider#authenticate(String, String)
- */
- @Override
- public AuthenticationResult authenticate(final String username, final String password)
- {
- try
- {
- if (_principalDatabase.verifyPassword(username, password.toCharArray()))
- {
- return new AuthenticationResult(new UsernamePrincipal(username, this));
- }
- else
- {
- return new AuthenticationResult(AuthenticationStatus.ERROR);
- }
- }
- catch (AccountNotFoundException e)
- {
- return new AuthenticationResult(AuthenticationStatus.ERROR);
- }
- }
-
- public PrincipalDatabase getPrincipalDatabase()
- {
- return _principalDatabase;
- }
-
- @Override
- @StateTransition(currentState = {State.UNINITIALIZED,State.ERRORED}, desiredState = State.ACTIVE)
- public CompletableFuture<Void> activate()
- {
- final CompletableFuture<Void> returnVal = new CompletableFuture<>();
- final List<Principal> users = _principalDatabase == null ? List.of() : _principalDatabase.getUsers();
- _userMap.clear();
- if(!users.isEmpty())
- {
- for (final Principal user : users)
- {
- final PrincipalAdapter principalAdapter = new PrincipalAdapter(user);
- principalAdapter.registerWithParents();
- principalAdapter.openAsync().whenCompleteAsync((result, error) ->
- {
- _userMap.put(user, principalAdapter);
- if (_userMap.size() == users.size())
- {
- setState(State.ACTIVE);
- returnVal.complete(null);
- }
- }, getTaskExecutor());
-
- }
-
- return returnVal;
- }
- else
- {
- setState(State.ACTIVE);
- return CompletableFuture.completedFuture(null);
- }
- }
-
- @Override
- protected CompletableFuture<Void> onDelete()
- {
- // We manage the storage children so we close (so they may free any resources) them rather than deleting them
- return closeChildren().whenComplete((result, error) ->
- {
- final File file = new File(_path);
- if (file.exists() && file.isFile())
- {
- file.delete();
- }
- });
- }
-
- @Override
- public boolean createUser(String username, String password, Map<String, String> attributes)
- {
- Map<String, Object> userAttrs = new HashMap<>();
- userAttrs.put(User.NAME, username);
- userAttrs.put(User.PASSWORD, password);
-
- User user = createChild(User.class, userAttrs);
- return user != null;
-
- }
-
-
- private void deleteUserFromDatabase(String username) throws AccountNotFoundException
- {
- UsernamePrincipal principal = new UsernamePrincipal(username, this);
- getPrincipalDatabase().deletePrincipal(principal);
- _userMap.remove(principal);
- }
-
- @Override
- public void deleteUser(String username) throws AccountNotFoundException
- {
- UsernamePrincipal principal = new UsernamePrincipal(username, this);
- PrincipalAdapter user = _userMap.get(principal);
- if(user != null)
- {
- user.delete();
- }
- else
- {
- throw new AccountNotFoundException("No such user: '" + username + "'");
- }
- }
-
- @Override
- public void setPassword(String username, String password) throws AccountNotFoundException
- {
- Principal principal = new UsernamePrincipal(username, this);
- User user = _userMap.get(principal);
- if (user != null)
- {
- user.setPassword(password);
- }
- }
-
- @Override
- public Map<String, Map<String, String>> getUsers()
- {
- Map<String, Map<String,String>> users = new HashMap<>();
- for(Principal principal : getPrincipalDatabase().getUsers())
- {
- users.put(principal.getName(), Map.of());
- }
- return users;
- }
-
- @Override
- public void reload() throws IOException
- {
- getPrincipalDatabase().reload();
- }
-
- @Override
- protected <C extends ConfiguredObject> CompletableFuture<C> addChildAsync(Class<C> childClass,
- Map<String, Object> attributes)
- {
- if(childClass == User.class)
- {
- String username = (String) attributes.get("name");
- String password = (String) attributes.get("password");
- Principal p = new UsernamePrincipal(username, this);
- PrincipalAdapter principalAdapter = new PrincipalAdapter(p);
- principalAdapter.create(); // for a duplicate user DuplicateNameException should be thrown
- try
- {
- boolean created = getPrincipalDatabase().createPrincipal(p, password.toCharArray());
- if (!created)
- {
- throw new IllegalArgumentException("User '" + username + "' was not added into principal database");
- }
- }
- catch (RuntimeException e)
- {
- principalAdapter.deleteNoChecks();
- throw e;
- }
- _userMap.put(p, principalAdapter);
- return CompletableFuture.completedFuture((C)principalAdapter);
- }
- else
- {
- return super.addChildAsync(childClass, attributes);
- }
- }
-
-
- @Override
- protected void validateChange(final ConfiguredObject<?> updatedObject, final Set<String> changedAttributes)
- {
- super.validateChange(updatedObject, changedAttributes);
-
- ExternalFileBasedAuthenticationManager<?> updated = (ExternalFileBasedAuthenticationManager<?>) updatedObject;
- if (changedAttributes.contains(NAME) && !getName().equals(updated.getName()))
- {
- throw new IllegalConfigurationException("Changing the name of authentication provider is not supported");
- }
- if (changedAttributes.contains(TYPE) && !getType().equals(updated.getType()))
- {
- throw new IllegalConfigurationException("Changing the type of authentication provider is not supported");
- }
- }
-
- @Override
- protected void changeAttributes(Map<String, Object> attributes)
- {
- super.changeAttributes(attributes);
- if(getState() != State.DELETED && getDesiredState() != State.DELETED)
- {
- // TODO - this does not belong here!
- try
- {
- initialise();
- // if provider was previously in ERRORED state then set its state to ACTIVE
- setState(State.ACTIVE);
- }
- catch(RuntimeException e)
- {
- if(getState() != State.ERRORED)
- {
- throw e;
- }
- }
- }
-
-
- }
-
- private class PrincipalAdapter extends AbstractConfiguredObject<PrincipalAdapter> implements User<PrincipalAdapter>
- {
- private final Principal _user;
-
- @ManagedAttributeField
- private String _password;
-
- public PrincipalAdapter(Principal user)
- {
- super(PrincipalDatabaseAuthenticationManager.this, createPrincipalAttributes(PrincipalDatabaseAuthenticationManager.this, user));
- _user = user;
-
- }
-
- @Override
- public void onValidate()
- {
- super.onValidate();
- if(!isDurable())
- {
- throw new IllegalArgumentException(getClass().getSimpleName() + " must be durable");
- }
- }
-
- @Override
- public String getPassword()
- {
- return _password;
- }
-
- @Override
- public void setPassword(String password)
- {
- setAttributes(Map.of(PASSWORD, password));
- }
-
- @Override
- protected void changeAttributes(final Map<String, Object> attributes)
- {
- if(attributes.containsKey(PASSWORD))
- {
- try
- {
- String desiredPassword = (String) attributes.get(PASSWORD);
- boolean changed = getPrincipalDatabase().updatePassword(_user, desiredPassword.toCharArray());
- if (!changed)
- {
- throw new IllegalStateException(String.format("Failed to user password for user : '%s'", getName()));
- }
- }
- catch(AccountNotFoundException e)
- {
- throw new IllegalStateException(e);
- }
- }
- super.changeAttributes(attributes);
- }
-
- @StateTransition(currentState = {State.UNINITIALIZED,State.ERRORED}, desiredState = State.ACTIVE)
- private CompletableFuture<Void> activate()
- {
- setState(State.ACTIVE);
- return CompletableFuture.completedFuture(null);
- }
-
- @Override
- protected CompletableFuture<Void> onDelete()
- {
- try
- {
- String userName = _user.getName();
- deleteUserFromDatabase(userName);
- }
- catch (AccountNotFoundException e)
- {
- // pass
- }
- return super.onDelete();
- }
-
- @Override
- protected CompletableFuture<Void> deleteNoChecks()
- {
- return super.deleteNoChecks();
- }
- }
-
- private static Map<String, Object> createPrincipalAttributes(PrincipalDatabaseAuthenticationManager manager, final Principal user)
- {
- final Map<String, Object> attributes = new HashMap<>();
- attributes.put(ID, UUID.randomUUID());
- attributes.put(NAME, user.getName());
- return attributes;
- }
-
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabaseTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabaseTest.java
deleted file mode 100644
index 3adbc25e3c..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/AbstractPasswordFilePrincipalDatabaseTest.java
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.qpid.server.security.auth.database;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.fail;
-
-import java.io.BufferedWriter;
-import java.io.File;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.test.utils.UnitTestBase;
-
-public abstract class AbstractPasswordFilePrincipalDatabaseTest extends UnitTestBase
-{
- protected static final String TEST_COMMENT = "# Test Comment";
- protected static final String TEST_USERNAME = "testUser";
- protected static final String TEST_PASSWORD = "testPassword";
- protected static final char[] TEST_PASSWORD_CHARS = TEST_PASSWORD.toCharArray();
-
- private final List<File> _testPwdFiles = new ArrayList<>();
- private final Principal _principal = new UsernamePrincipal(TEST_USERNAME, null);
-
- protected abstract AbstractPasswordFilePrincipalDatabase<?> getDatabase();
-
- @AfterEach
- public void tearDown() throws Exception
- {
- //clean up any additional files and their backups
- for (final File f : _testPwdFiles)
- {
- final File oldPwdFile = new File(f.getAbsolutePath() + ".old");
- if (oldPwdFile.exists())
- {
- oldPwdFile.delete();
- }
-
- f.delete();
- }
- }
-
- protected File createPasswordFile(final int commentLines, final int users)
- {
- try
- {
- final File testFile = File.createTempFile(getTestName(), "tmp");
- testFile.deleteOnExit();
-
- try (final BufferedWriter writer = new BufferedWriter(new FileWriter(testFile)))
- {
-
- for (int i = 0; i < commentLines; i++)
- {
- writer.write(TEST_COMMENT);
- writer.newLine();
- }
-
- for (int i = 0; i < users; i++)
- {
- writer.write(TEST_USERNAME + i + ":Password");
- writer.newLine();
- }
-
- writer.flush();
- }
-
- _testPwdFiles.add(testFile);
-
- return testFile;
-
- }
- catch (IOException e)
- {
- fail("Unable to create test password file." + e.getMessage());
- }
-
- return null;
- }
-
-
- protected void loadPasswordFile(final File file)
- {
- assertDoesNotThrow(() -> getDatabase().open(file), "Password File was not created");
- }
-
-
- @Test
- public void testRejectUsernameWithColon()
- {
- final String usernameWithColon = "user:name";
- final Principal principal = new UsernamePrincipal(usernameWithColon, null);
- final File testFile = createPasswordFile(0, 0);
- loadPasswordFile(testFile);
-
- assertThrows(IllegalArgumentException.class,
- () -> getDatabase().createPrincipal(principal, TEST_PASSWORD_CHARS),
- "Username with colon should be rejected");
- }
-
- @Test
- public void testRejectPasswordWithColon()
- {
- final String username = "username";
- final String passwordWithColon = "pass:word";
- final Principal principal = new UsernamePrincipal(username, null);
- final File testFile = createPasswordFile(0, 0);
- loadPasswordFile(testFile);
-
- assertThrows(IllegalArgumentException.class,
- () -> getDatabase().createPrincipal(principal, passwordWithColon.toCharArray()),
- "Password with colon should be rejected");
-
- getDatabase().createPrincipal(_principal, TEST_PASSWORD_CHARS);
-
- assertThrows(
- IllegalArgumentException.class,
- () -> getDatabase().updatePassword(_principal, passwordWithColon.toCharArray()),
- "Password with colon should be rejected");
- }
-
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabaseTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabaseTest.java
deleted file mode 100644
index eecabfe047..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/Base64MD5PasswordFilePrincipalDatabaseTest.java
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.junit.jupiter.api.Assertions.fail;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.FileReader;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.Base64;
-import java.util.List;
-import java.util.regex.Pattern;
-
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-
-public class Base64MD5PasswordFilePrincipalDatabaseTest extends AbstractPasswordFilePrincipalDatabaseTest
-{
- private static final String PASSWORD = "guest";
- private static final String PASSWORD_B64MD5HASHED = "CE4DQ6BIb/BVMN9scFyLtA==";
- private static final char[] PASSWORD_MD5_CHARS;
- private static final String PRINCIPAL_USERNAME = "testUserPrincipal";
- private static final Principal PRINCIPAL = new UsernamePrincipal(PRINCIPAL_USERNAME, null);
- private Base64MD5PasswordFilePrincipalDatabase _database;
- private File _pwdFile;
-
- static
- {
- final byte[] decoded = Base64.getDecoder().decode(PASSWORD_B64MD5HASHED);
- PASSWORD_MD5_CHARS = new char[decoded.length];
- for (int i = 0; i < decoded.length; i++)
- {
- PASSWORD_MD5_CHARS[i] = (char) decoded[i];
- }
- }
-
- @BeforeEach
- public void setUp() throws Exception
- {
- _database = new Base64MD5PasswordFilePrincipalDatabase(null);
- _pwdFile = File.createTempFile(this.getClass().getName(), "pwd");
- _pwdFile.deleteOnExit();
- _database.open(_pwdFile);
- }
-
- @AfterEach
- public void tearDown() throws Exception
- {
- try
- {
- //clean up the created default password file and any backup
- final File oldPwdFile = new File(_pwdFile.getAbsolutePath() + ".old");
- if (oldPwdFile.exists())
- {
- oldPwdFile.delete();
- }
- _pwdFile.delete();
- }
- finally
- {
- super.tearDown();
- }
- }
-
- @Override
- protected AbstractPasswordFilePrincipalDatabase<?> getDatabase()
- {
- return _database;
- }
-
- /** **** Test Methods ************** */
-
- @Test
- public void testCreatePrincipal()
- {
- final File testFile = createPasswordFile(1, 0);
- loadPasswordFile(testFile);
-
- final Principal principal = () -> TEST_USERNAME;
-
- assertTrue(_database.createPrincipal(principal, PASSWORD.toCharArray()), "New user not created.");
-
- final PasswordCallback callback = new PasswordCallback("prompt",false);
- assertDoesNotThrow(() -> _database.setPassword(principal, callback),
- "User account did not exist");
-
- final char[] password = callback.getPassword();
- assertArrayEquals(PASSWORD_MD5_CHARS, password, "Password returned was incorrect.");
-
- loadPasswordFile(testFile);
-
- assertDoesNotThrow(() -> _database.setPassword(principal, callback),
- "User account did not exist");
-
- assertArrayEquals(PASSWORD_MD5_CHARS, callback.getPassword(), "Password returned was incorrect.");
- assertNotNull(_database.getUser(TEST_USERNAME), "Created User was not saved");
- assertFalse(_database.createPrincipal(principal, PASSWORD.toCharArray()), "Duplicate user created.");
- }
-
- @Test
- public void testCreatePrincipalIsSavedToFile()
- {
- final File testFile = createPasswordFile(1, 0);
- loadPasswordFile(testFile);
-
- final String CREATED_PASSWORD = "guest";
- final String CREATED_B64MD5HASHED_PASSWORD = "CE4DQ6BIb/BVMN9scFyLtA==";
- final String CREATED_USERNAME = "createdUser";
-
- final Principal principal = () -> CREATED_USERNAME;
-
- _database.createPrincipal(principal, CREATED_PASSWORD.toCharArray());
-
- try (final BufferedReader reader = new BufferedReader(new FileReader(testFile)))
- {
- assertTrue(reader.ready(), "File has no content");
- assertEquals(TEST_COMMENT, reader.readLine(), "Comment line has been corrupted.");
- assertTrue(reader.ready(), "File is missing user data.");
-
- final String userLine = reader.readLine();
- final String[] result = Pattern.compile(":").split(userLine);
-
- assertEquals(2, (long) result.length, "User line not complete '" + userLine + "'");
- assertEquals(CREATED_USERNAME, result[0], "Username not correct,");
- assertEquals(CREATED_B64MD5HASHED_PASSWORD, result[1], "Password not correct,");
- assertFalse(reader.ready(), "File has more content");
- }
- catch (IOException e)
- {
- fail("Unable to validate file contents due to:" + e.getMessage());
- }
- }
-
-
- @Test
- public void testDeletePrincipal()
- {
- final File testFile = createPasswordFile(1, 1);
- loadPasswordFile(testFile);
-
- final Principal user = _database.getUser(TEST_USERNAME + "0");
- assertNotNull(user, "Generated user not present.");
-
- assertDoesNotThrow(() -> _database.deletePrincipal(user), "User should be present");
- assertThrows(AccountNotFoundException.class, () -> _database.deletePrincipal(user),
- "User should not be present");
-
- loadPasswordFile(testFile);
-
- assertThrows(AccountNotFoundException.class, () -> _database.deletePrincipal(user),
- "User should not be present");
- assertNull(_database.getUser(TEST_USERNAME + "0"), "Deleted user still present.");
- }
-
- @Test
- public void testGetUsers()
- {
- final int USER_COUNT = 10;
- final File testFile = createPasswordFile(1, USER_COUNT);
- loadPasswordFile(testFile);
-
- final Principal user = _database.getUser("MISSING_USERNAME");
- assertNull(user, "Missing user present.");
-
- final List<Principal> users = _database.getUsers();
-
- assertNotNull(users, "Users list is null.");
-
- assertEquals(USER_COUNT, (long) users.size());
-
- final boolean[] verify = new boolean[USER_COUNT];
- for (int i = 0; i < USER_COUNT; i++)
- {
- final Principal principal = users.get(i);
-
- assertNotNull(principal, "Generated user not present.");
-
- final String name = principal.getName();
-
- final int id = Integer.parseInt(name.substring(TEST_USERNAME.length()));
-
- assertFalse(verify[id], "Duplicated username retrieve");
- verify[id] = true;
- }
-
- for (int i = 0; i < USER_COUNT; i++)
- {
- assertTrue(verify[i], "User " + i + " missing");
- }
- }
-
- @Test
- public void testUpdatePasswordIsSavedToFile()
- {
- final File testFile = createPasswordFile(1, 1);
- loadPasswordFile(testFile);
-
- final Principal testUser = _database.getUser(TEST_USERNAME + "0");
-
- assertNotNull(testUser);
-
- final String NEW_PASSWORD = "guest";
- final String NEW_PASSWORD_HASH = "CE4DQ6BIb/BVMN9scFyLtA==";
- assertDoesNotThrow(() -> _database.updatePassword(testUser, NEW_PASSWORD.toCharArray()));
-
- try (final BufferedReader reader = new BufferedReader(new FileReader(testFile)))
- {
- assertTrue(reader.ready(), "File has no content");
- assertEquals(TEST_COMMENT, reader.readLine(), "Comment line has been corrupted.");
- assertTrue(reader.ready(), "File is missing user data.");
-
- final String userLine = reader.readLine();
- final String[] result = Pattern.compile(":").split(userLine);
-
- assertEquals(2, (long) result.length, "User line not complete '" + userLine + "'");
- assertEquals(TEST_USERNAME + "0", result[0], "Username not correct,");
- assertEquals(NEW_PASSWORD_HASH, result[1], "New Password not correct,");
- assertFalse(reader.ready(), "File has more content");
- }
- catch (IOException e)
- {
- fail("Unable to validate file contents due to:" + e.getMessage());
- }
- }
-
- @Test
- public void testSetPasswordFileWithMissingFile()
- {
- try
- {
- _database.open(new File("DoesntExist"));
- }
- catch (FileNotFoundException fnfe)
- {
- assertTrue(fnfe.getMessage().startsWith("Cannot find password file"), fnfe.getMessage());
- }
- catch (IOException e)
- {
- fail("Password File was not created." + e.getMessage());
- }
- }
-
- @Test
- public void testSetPasswordFileWithReadOnlyFile()
- {
- final File testFile = createPasswordFile(0, 0);
- testFile.setReadOnly();
-
- try
- {
- _database.open(testFile);
- }
- catch (FileNotFoundException fnfe)
- {
- assertTrue(fnfe.getMessage().startsWith("Cannot read password file "));
- }
- catch (IOException e)
- {
- fail("Password File was not created." + e.getMessage());
- }
- }
-
- @Test
- public void testCreateUserPrincipal()
- {
- _database.createPrincipal(PRINCIPAL, PASSWORD.toCharArray());
- final Principal newPrincipal = _database.getUser(PRINCIPAL_USERNAME);
- assertNotNull(newPrincipal);
- assertEquals(PRINCIPAL.getName(), newPrincipal.getName());
- }
-
- @Test
- public void testVerifyPassword() throws AccountNotFoundException
- {
- testCreateUserPrincipal();
- //assertFalse(_pwdDB.verifyPassword(_username, null));
- assertFalse(_database.verifyPassword(PRINCIPAL_USERNAME, new char[]{}));
- assertFalse(_database.verifyPassword(PRINCIPAL_USERNAME, (PASSWORD + "z").toCharArray()));
- assertTrue(_database.verifyPassword(PRINCIPAL_USERNAME, PASSWORD.toCharArray()));
-
- assertThrows(AccountNotFoundException.class,
- () -> _database.verifyPassword("made.up.username", PASSWORD.toCharArray()),
- "Should not have been able to verify this nonexistent users password.");
- }
-
- @Test
- public void testUpdatePassword() throws AccountNotFoundException
- {
- testCreateUserPrincipal();
- final char[] newPwd = "newpassword".toCharArray();
- _database.updatePassword(PRINCIPAL, newPwd);
- assertFalse(_database.verifyPassword(PRINCIPAL_USERNAME, PASSWORD.toCharArray()));
- assertTrue(_database.verifyPassword(PRINCIPAL_USERNAME, newPwd));
- }
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/HashedUserTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/HashedUserTest.java
deleted file mode 100644
index 54770f4096..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/HashedUserTest.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.fail;
-
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.test.utils.UnitTestBase;
-
-/*
- Note User is mainly tested by Base64MD5PFPDTest this is just to catch the extra methods
- */
-public class HashedUserTest extends UnitTestBase
-{
- private final String USERNAME = "username";
- private final String PASSWORD = "password";
-
- @Test
- public void testToLongArrayConstructor()
- {
- final IllegalArgumentException thrown = assertThrows(IllegalArgumentException.class,
- () -> new HashedUser(new String[]{USERNAME, PASSWORD, USERNAME}, null),
- "Error expected");
- assertEquals("User Data should be length 2, username, password", thrown.getMessage());
- }
-
- @Test
- public void testArrayConstructor()
- {
- final String b64EncodedPassword = "cGFzc3dvcmQ=";
- final HashedUser user = new HashedUser(new String[]{USERNAME, b64EncodedPassword}, null);
- assertEquals(USERNAME, user.getName(), "Username incorrect");
- int index = 0;
-
- char[] hash = b64EncodedPassword.toCharArray();
-
- try
- {
- for (byte c : user.getEncodedPassword())
- {
- assertEquals(hash[index], (long) (char) c, "Password incorrect");
- index++;
- }
- }
- catch (Exception e)
- {
- fail(e.getMessage());
- }
-
- hash = PASSWORD.toCharArray();
-
- index=0;
- for (char c : user.getPassword())
- {
- assertEquals(hash[index], (long) c, "Password incorrect");
- index++;
- }
- }
-}
-
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java
deleted file mode 100644
index 0e55037831..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java
+++ /dev/null
@@ -1,299 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.junit.jupiter.api.Assertions.fail;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.FileReader;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.regex.Pattern;
-
-import javax.security.auth.login.AccountNotFoundException;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.server.security.auth.manager.AbstractScramAuthenticationManager;
-
-public class PlainPasswordFilePrincipalDatabaseTest extends AbstractPasswordFilePrincipalDatabaseTest
-{
- private final Principal _principal = new UsernamePrincipal(TEST_USERNAME, null);
- private PlainPasswordFilePrincipalDatabase _database;
- private final List<File> _testPwdFiles = new ArrayList<>();
-
- @BeforeEach
- public void setUp() throws Exception
- {
- final PasswordCredentialManagingAuthenticationProvider<?>
- mockAuthenticationProvider = mock(PasswordCredentialManagingAuthenticationProvider.class);
- when(mockAuthenticationProvider.getContextValue(Integer.class, AbstractScramAuthenticationManager.QPID_AUTHMANAGER_SCRAM_ITERATION_COUNT)).thenReturn(4096);
- _database = new PlainPasswordFilePrincipalDatabase(mockAuthenticationProvider);
- _testPwdFiles.clear();
- }
-
- @Override
- protected AbstractPasswordFilePrincipalDatabase<?> getDatabase()
- {
- return _database;
- }
-
- // ******* Test Methods ********** //
-
- @Test
- public void testCreatePrincipal()
- {
- final File testFile = createPasswordFile(1, 0);
- loadPasswordFile(testFile);
-
- final String CREATED_PASSWORD = "guest";
- final String CREATED_USERNAME = "createdUser";
- final Principal principal = () -> CREATED_USERNAME;
-
- assertTrue(_database.createPrincipal(principal, CREATED_PASSWORD.toCharArray()), "New user not created.");
-
- loadPasswordFile(testFile);
-
- assertNotNull(_database.getUser(CREATED_USERNAME), "Created User was not saved");
- assertFalse(_database.createPrincipal(principal, CREATED_PASSWORD.toCharArray()), "Duplicate user created.");
- testFile.delete();
- }
-
- @Test
- public void testCreatePrincipalIsSavedToFile()
- {
- final File testFile = createPasswordFile(1, 0);
- loadPasswordFile(testFile);
-
- final Principal principal = () -> TEST_USERNAME;
-
- _database.createPrincipal(principal, TEST_PASSWORD_CHARS);
-
- try (final BufferedReader reader = new BufferedReader(new FileReader(testFile)))
- {
- assertTrue(reader.ready(), "File has no content");
- assertEquals(TEST_COMMENT, reader.readLine(), "Comment line has been corrupted.");
- assertTrue(reader.ready(), "File is missing user data.");
-
- final String userLine = reader.readLine();
- final String[] result = Pattern.compile(":").split(userLine);
-
- assertEquals(2, (long) result.length, "User line not complete '" + userLine + "'");
- assertEquals(TEST_USERNAME, result[0], "Username not correct,");
- assertEquals(TEST_PASSWORD, result[1], "Password not correct,");
- assertFalse(reader.ready(), "File has more content");
- }
- catch (IOException e)
- {
- fail("Unable to validate file contents due to:" + e.getMessage());
- }
- testFile.delete();
- }
-
- @Test
- public void testDeletePrincipal()
- {
- final File testFile = createPasswordFile(1, 1);
- loadPasswordFile(testFile);
-
- final Principal user = _database.getUser(TEST_USERNAME + "0");
- assertNotNull(user, "Generated user not present.");
-
- assertDoesNotThrow(() -> _database.deletePrincipal(user), "User should be present");
-
- assertThrows(AccountNotFoundException.class, () -> _database.deletePrincipal(user),
- "User should not be present");
-
- loadPasswordFile(testFile);
-
- assertThrows(AccountNotFoundException.class, () -> _database.deletePrincipal(user), "User should not be present");
- assertNull(_database.getUser(TEST_USERNAME + "0"), "Deleted user still present.");
-
- testFile.delete();
- }
-
- @Test
- public void testGetUsers()
- {
- final int USER_COUNT = 10;
- final File testFile = createPasswordFile(1, USER_COUNT);
- loadPasswordFile(testFile);
-
- final Principal user = _database.getUser("MISSING_USERNAME");
- assertNull(user, "Missing user present.");
-
- final List<Principal> users = _database.getUsers();
-
- assertNotNull(users, "Users list is null.");
- assertEquals(USER_COUNT, (long) users.size());
-
- final boolean[] verify = new boolean[USER_COUNT];
- for (int i = 0; i < USER_COUNT; i++)
- {
- final Principal principal = users.get(i);
-
- assertNotNull(principal, "Generated user not present.");
-
- final String name = principal.getName();
- final int id = Integer.parseInt(name.substring(TEST_USERNAME.length()));
-
- assertFalse(verify[id], "Duplicated username retrieve");
- verify[id] = true;
- }
-
- for (int i = 0; i < USER_COUNT; i++)
- {
- assertTrue(verify[i], "User " + i + " missing");
- }
-
- testFile.delete();
- }
-
- @Test
- public void testUpdatePasswordIsSavedToFile()
- {
- final File testFile = createPasswordFile(1, 1);
- loadPasswordFile(testFile);
-
- final Principal testUser = _database.getUser(TEST_USERNAME + "0");
-
- assertNotNull(testUser);
-
- final String NEW_PASSWORD = "NewPassword";
- assertDoesNotThrow(() -> _database.updatePassword(testUser, NEW_PASSWORD.toCharArray()));
-
- try (final BufferedReader reader = new BufferedReader(new FileReader(testFile)))
- {
- assertTrue(reader.ready(), "File has no content");
- assertEquals(TEST_COMMENT, reader.readLine(), "Comment line has been corrupted.");
- assertTrue(reader.ready(), "File is missing user data.");
-
- final String userLine = reader.readLine();
- final String[] result = Pattern.compile(":").split(userLine);
-
- assertEquals(2, (long) result.length, "User line not complete '" + userLine + "'");
- assertEquals(TEST_USERNAME + "0", result[0], "Username not correct,");
- assertEquals(NEW_PASSWORD, result[1], "New Password not correct,");
- assertFalse(reader.ready(), "File has more content");
- }
- catch (IOException e)
- {
- fail("Unable to validate file contents due to:" + e.getMessage());
- }
- testFile.delete();
- }
-
- @Test
- public void testSetPasswordFileWithMissingFile()
- {
- try
- {
- _database.open(new File("DoesntExist"));
- }
- catch (FileNotFoundException fnfe)
- {
- assertTrue(fnfe.getMessage().startsWith("Cannot find password file"), fnfe.getMessage());
- }
- catch (IOException e)
- {
- fail("Password File was not created." + e.getMessage());
- }
-
- }
-
- @Test
- public void testSetPasswordFileWithReadOnlyFile()
- {
- final File testFile = createPasswordFile(0, 0);
- testFile.setReadOnly();
-
- try
- {
- _database.open(testFile);
- }
- catch (FileNotFoundException fnfe)
- {
- assertTrue(fnfe.getMessage().startsWith("Cannot read password file "));
- }
- catch (IOException e)
- {
- fail("Password File was not created." + e.getMessage());
- }
-
- testFile.delete();
- }
-
- @Test
- public void testCreateUserPrincipal()
- {
- final Principal newPrincipal = createUserPrincipal();
- assertNotNull(newPrincipal);
- assertEquals(_principal.getName(), newPrincipal.getName());
- }
-
- private Principal createUserPrincipal()
- {
- final File testFile = createPasswordFile(0, 0);
- loadPasswordFile(testFile);
-
- _database.createPrincipal(_principal, TEST_PASSWORD_CHARS);
- return _database.getUser(TEST_USERNAME);
- }
-
- @Test
- public void testVerifyPassword() throws AccountNotFoundException
- {
- createUserPrincipal();
- assertFalse(_database.verifyPassword(TEST_USERNAME, new char[]{}));
- assertFalse(_database.verifyPassword(TEST_USERNAME, "massword".toCharArray()));
- assertTrue(_database.verifyPassword(TEST_USERNAME, TEST_PASSWORD_CHARS));
-
- assertThrows(AccountNotFoundException.class,
- () -> _database.verifyPassword("made.up.username", TEST_PASSWORD_CHARS),
- "Should not have been able to verify this non-existant users password.");
- }
-
- @Test
- public void testUpdatePassword() throws AccountNotFoundException
- {
- createUserPrincipal();
- final char[] newPwd = "newpassword".toCharArray();
- _database.updatePassword(_principal, newPwd);
- assertFalse(_database.verifyPassword(TEST_USERNAME, TEST_PASSWORD_CHARS));
- assertTrue(_database.verifyPassword(TEST_USERNAME, newPwd));
- }
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java
deleted file mode 100644
index 48b1a53686..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.database;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.fail;
-
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.test.utils.UnitTestBase;
-
-
-/*
- Note PlainUser is mainly tested by PlainPFPDTest, this is just to catch the extra methods
- */
-public class PlainUserTest extends UnitTestBase
-{
- private final String USERNAME = "username";
- private final String PASSWORD = "password";
-
- @Test
- public void testTooLongArrayConstructor()
- {
- final IllegalArgumentException thrown = assertThrows(IllegalArgumentException.class,
- () -> new PlainUser(new String[]{USERNAME, PASSWORD, USERNAME}, null),
- "Error expected");
- assertEquals("User Data should be length 2, username, password", thrown.getMessage());
- }
-
- @Test
- public void testStringArrayConstructor()
- {
- final PlainUser user = new PlainUser(new String[]{USERNAME, PASSWORD}, null);
- assertEquals(USERNAME, user.getName(), "Username incorrect");
- int index = 0;
-
- char[] password = PASSWORD.toCharArray();
-
- try
- {
- for (byte c : user.getEncodedPassword())
- {
- assertEquals(password[index], (long) (char) c, "Password incorrect");
- index++;
- }
- }
- catch (Exception e)
- {
- fail(e.getMessage());
- }
-
- password = PASSWORD.toCharArray();
-
- index=0;
- for (char c : user.getPassword())
- {
- assertEquals(password[index], (long) c, "Password incorrect");
- index++;
- }
- }
-}
-
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManagerTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManagerTest.java
deleted file mode 100644
index 2522e281b9..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordDatabaseAuthenticationManagerTest.java
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-
-package org.apache.qpid.server.security.auth.manager;
-
-import static org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus.SUCCESS;
-import static org.apache.qpid.server.security.auth.manager.PlainPasswordDatabaseAuthenticationManager.PROVIDER_TYPE;
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-import java.io.File;
-import java.util.Map;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.model.AuthenticationProvider;
-import org.apache.qpid.server.model.Broker;
-import org.apache.qpid.server.model.BrokerTestHelper;
-import org.apache.qpid.server.model.ConfiguredObjectFactory;
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.model.User;
-import org.apache.qpid.server.security.auth.AuthenticationResult;
-import org.apache.qpid.test.utils.TestFileUtils;
-import org.apache.qpid.test.utils.UnitTestBase;
-
-public class PlainPasswordDatabaseAuthenticationManagerTest extends UnitTestBase
-{
- private Broker<?> _broker;
- private File _passwordFile;
- private ConfiguredObjectFactory _objectFactory;
-
- @BeforeEach
- public void setUp() throws Exception
- {
- _broker = BrokerTestHelper.createNewBrokerMock();
- _objectFactory = _broker.getObjectFactory();
- }
-
- @AfterEach
- public void tearDown() throws Exception
- {
- if (_passwordFile.exists())
- {
- _passwordFile.delete();
- }
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testExistingPasswordFile()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password", "user:password");
-
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, _passwordFile.getAbsolutePath(),
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- final AuthenticationProvider<?> provider = _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(1)));
-
- final User<?> user = (User<?>) provider.getChildByName(User.class, "user");
- assertThat(user.getName(), is(equalTo("user")));
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testAddUser()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password");
-
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, _passwordFile.getAbsolutePath(),
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- final AuthenticationProvider<?> provider = _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(0)));
-
- final Map<String, Object> userAttrs = Map.of(User.TYPE, PROVIDER_TYPE,
- User.NAME, "user",
- User.PASSWORD, "password");
- final User<?> user = (User<?>) provider.createChild(User.class, userAttrs);
-
- assertThat(provider.getChildren(User.class).size(), is(equalTo(1)));
- assertThat(user.getName(), is(equalTo("user")));
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testRemoveUser()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password", "user:password");
-
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, _passwordFile.getAbsolutePath(),
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- final AuthenticationProvider<?> provider = _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(1)));
-
- final User<?> user = (User<?>) provider.getChildByName(User.class, "user");
- user.delete();
-
- assertThat(provider.getChildren(User.class).size(), is(equalTo(0)));
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testDurability()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password");
-
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, _passwordFile.getAbsolutePath(),
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- {
- final AuthenticationProvider<?> provider =
- _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(0)));
-
- final Map<String, Object> userAttrs =Map.of(User.TYPE, PROVIDER_TYPE,
- User.NAME, "user",
- User.PASSWORD, "password");
- provider.createChild(User.class, userAttrs);
-
- provider.close();
- }
-
- {
- final AuthenticationProvider<?> provider =
- _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(1)));
-
- final User<?> user = (User<?>) provider.getChildByName(User.class, "user");
- user.delete();
-
- provider.close();
- }
-
- {
- final AuthenticationProvider<?> provider =
- _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- assertThat(provider.getChildren(User.class).size(), is(equalTo(0)));
-
- provider.close();
- }
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testAuthenticate()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password", "user:password");
-
- final String file = _passwordFile.getAbsolutePath();
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, file,
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- final PasswordCredentialManagingAuthenticationProvider<?> provider =
- ((PasswordCredentialManagingAuthenticationProvider<?>) _objectFactory.create(AuthenticationProvider.class,
- providerAttrs,
- _broker));
-
- {
- final AuthenticationResult result = provider.authenticate("user", "password");
- assertThat(result.getStatus(), is(equalTo(SUCCESS)));
- }
-
- {
- final AuthenticationResult result = provider.authenticate("user", "badpassword");
- assertThat(result.getStatus(), is(equalTo(AuthenticationResult.AuthenticationStatus.ERROR)));
- }
-
- {
- final AuthenticationResult result = provider.authenticate("unknownuser", "badpassword");
- assertThat(result.getStatus(), is(equalTo(AuthenticationResult.AuthenticationStatus.ERROR)));
- }
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testDeleteProvider()
- {
- _passwordFile = TestFileUtils.createTempFile(this, ".user.password", "user:password");
-
- final Map<String, Object> providerAttrs = Map.of(PlainPasswordDatabaseAuthenticationManager.TYPE, PROVIDER_TYPE,
- PlainPasswordDatabaseAuthenticationManager.PATH, _passwordFile.getAbsolutePath(),
- PlainPasswordDatabaseAuthenticationManager.NAME, getTestName());
-
- final AuthenticationProvider<?> provider = _objectFactory.create(AuthenticationProvider.class, providerAttrs, _broker);
- provider.delete();
-
- assertThat(_passwordFile.exists(), is(equalTo(false)));
- }
-}
\ No newline at end of file
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordFileAuthenticationManagerFactoryTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordFileAuthenticationManagerFactoryTest.java
deleted file mode 100644
index 5f45a76a84..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PlainPasswordFileAuthenticationManagerFactoryTest.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.manager;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.File;
-import java.util.HashMap;
-import java.util.Map;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.model.AuthenticationProvider;
-import org.apache.qpid.server.model.Broker;
-import org.apache.qpid.server.model.BrokerModel;
-import org.apache.qpid.server.model.BrokerTestHelper;
-import org.apache.qpid.server.model.ConfiguredObjectFactory;
-import org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase;
-import org.apache.qpid.test.utils.UnitTestBase;
-
-public class PlainPasswordFileAuthenticationManagerFactoryTest extends UnitTestBase
-{
- private final ConfiguredObjectFactory _factory = BrokerModel.getInstance().getObjectFactory();
- private final Map<String, Object> _configuration = new HashMap<>();
- private File _emptyPasswordFile;
- private final Broker<?> _broker = BrokerTestHelper.createBrokerMock();
-
- @BeforeEach
- public void setUp() throws Exception
- {
- _emptyPasswordFile = File.createTempFile(getTestName(), "passwd");
- _emptyPasswordFile.deleteOnExit();
- _configuration.put(AuthenticationProvider.ID, randomUUID());
- _configuration.put(AuthenticationProvider.NAME, getTestName());
- }
-
- @AfterEach
- public void tearDown() throws Exception
- {
- if (_emptyPasswordFile != null && _emptyPasswordFile.exists())
- {
- _emptyPasswordFile.delete();
- }
- }
-
- @Test
- @SuppressWarnings({"rawtypes", "unchecked"})
- public void testPlainInstanceCreated()
- {
- _configuration.put(AuthenticationProvider.TYPE, PlainPasswordDatabaseAuthenticationManager.PROVIDER_TYPE);
- _configuration.put("path", _emptyPasswordFile.getAbsolutePath());
-
- final AuthenticationProvider<?> manager = _factory.create(AuthenticationProvider.class, _configuration, _broker);
- assertNotNull(manager);
- assertTrue(manager instanceof PrincipalDatabaseAuthenticationManager);
- assertTrue(((PrincipalDatabaseAuthenticationManager)manager).getPrincipalDatabase() instanceof PlainPasswordFilePrincipalDatabase);
- }
-
- @Test
- @SuppressWarnings({"rawtypes", "unchecked"})
- public void testPasswordFileNotFound()
- {
- //delete the file
- _emptyPasswordFile.delete();
-
- _configuration.put(AuthenticationProvider.TYPE, PlainPasswordDatabaseAuthenticationManager.PROVIDER_TYPE);
- _configuration.put("path", _emptyPasswordFile.getAbsolutePath());
-
- final AuthenticationProvider<?> manager = _factory.create(AuthenticationProvider.class, _configuration, _broker);
-
- assertNotNull(manager);
- assertTrue(manager instanceof PrincipalDatabaseAuthenticationManager);
- assertTrue(((PrincipalDatabaseAuthenticationManager)manager).getPrincipalDatabase() instanceof PlainPasswordFilePrincipalDatabase);
- }
-
- @Test
- @SuppressWarnings("unchecked")
- public void testThrowsExceptionWhenConfigForPlainPDImplementationNoPasswordFileValueSpecified()
- {
- _configuration.put(AuthenticationProvider.TYPE, PlainPasswordDatabaseAuthenticationManager.PROVIDER_TYPE);
-
- assertThrows(IllegalArgumentException.class,
- () -> _factory.create(AuthenticationProvider.class, _configuration, _broker),
- "No authentication manager should be created");
- }
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManagerTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManagerTest.java
deleted file mode 100644
index 1c12079c28..0000000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/PrincipalDatabaseAuthenticationManagerTest.java
+++ /dev/null
@@ -1,303 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.qpid.server.security.auth.manager;
-
-import static org.apache.qpid.server.security.auth.AuthenticatedPrincipalTestHelper.assertOnlyContainsWrapped;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.security.Principal;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import org.apache.qpid.server.configuration.IllegalConfigurationException;
-import org.apache.qpid.server.model.BrokerTestHelper;
-import org.apache.qpid.server.model.ConfiguredObject;
-import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
-import org.apache.qpid.server.security.auth.AuthenticationResult;
-import org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus;
-import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase;
-import org.apache.qpid.server.security.auth.database.PrincipalDatabase;
-import org.apache.qpid.server.security.auth.sasl.SaslNegotiator;
-import org.apache.qpid.server.security.auth.sasl.SaslSettings;
-import org.apache.qpid.test.utils.UnitTestBase;
-
-/**
- * Tests the public methods of PrincipalDatabaseAuthenticationManager.
- */
-public class PrincipalDatabaseAuthenticationManagerTest extends UnitTestBase
-{
- private static final String MOCK_MECH_NAME = "MOCK-MECH-NAME";
-
- private final SaslNegotiator _saslNegotiator = mock(SaslNegotiator.class);
-
- private PrincipalDatabaseAuthenticationManager<?> _manager = null; // Class under test
- private PrincipalDatabase _principalDatabase;
- private String _passwordFileLocation;
-
- @BeforeEach
- public void setUp() throws Exception
- {
- _passwordFileLocation = TMP_FOLDER + File.separator +
- PrincipalDatabaseAuthenticationManagerTest.class.getSimpleName() + "-" + getTestName();
- deletePasswordFileIfExists();
- }
-
- @AfterEach
- public void tearDown() throws Exception
- {
- try
- {
- if (_manager != null)
- {
- _manager.close();
- }
- }
- finally
- {
- deletePasswordFileIfExists();
- }
- }
-
- private void setupMocks()
- {
- setUpPrincipalDatabase();
- setupManager(false);
- _manager.initialise();
- }
-
- private void setUpPrincipalDatabase()
- {
- _principalDatabase = mock(PrincipalDatabase.class);
- when(_principalDatabase.getMechanisms()).thenReturn(Collections.singletonList(MOCK_MECH_NAME));
- when(_principalDatabase.createSaslNegotiator(eq(MOCK_MECH_NAME), any(SaslSettings.class))).thenReturn(
- _saslNegotiator);
- }
-
- private void setupManager(final boolean recovering)
- {
- final Map<String,Object> attrs = Map.of(ConfiguredObject.ID, randomUUID(),
- ConfiguredObject.NAME, getTestName(),
- "path", _passwordFileLocation);
- _manager = getPrincipalDatabaseAuthenticationManager(attrs);
- if (recovering)
- {
- _manager.open();
- }
- else
- {
- _manager.create();
- }
- }
-
- @Test
- public void testInitialiseWhenPasswordFileNotFound()
- {
- final PasswordCredentialManagingAuthenticationProvider<?> mockAuthProvider =
- mock(PasswordCredentialManagingAuthenticationProvider.class);
- when(mockAuthProvider.getContextValue(Integer.class, AbstractScramAuthenticationManager.QPID_AUTHMANAGER_SCRAM_ITERATION_COUNT)).thenReturn(4096);
- _principalDatabase = new PlainPasswordFilePrincipalDatabase(mockAuthProvider);
- setupManager(true);
-
- final IllegalConfigurationException thrown = assertThrows(
- IllegalConfigurationException.class,
- () -> _manager.initialise(),
- "Initialization should fail when users file does not exist");
- assertTrue(thrown.getCause() instanceof FileNotFoundException);
- }
-
- @Test
- public void testInitialiseWhenPasswordFileExists() throws Exception
- {
- final PasswordCredentialManagingAuthenticationProvider<?> mockAuthProvider =
- mock(PasswordCredentialManagingAuthenticationProvider.class);
- when(mockAuthProvider.getContextValue(Integer.class, AbstractScramAuthenticationManager.QPID_AUTHMANAGER_SCRAM_ITERATION_COUNT)).thenReturn(4096);
- _principalDatabase = new PlainPasswordFilePrincipalDatabase(mockAuthProvider);
- setupManager(true);
-
- final File file = new File(_passwordFileLocation);
- if (file.createNewFile())
- {
- try (final FileOutputStream fos = new FileOutputStream(file))
- {
- fos.write("admin:admin".getBytes());
- }
- }
- _manager.initialise();
- final List<Principal> users = _principalDatabase.getUsers();
- assertEquals(1, (long) users.size(), "Unexpected uses size");
- final Principal p = _principalDatabase.getUser("admin");
- assertEquals("admin", p.getName(), "Unexpected principal name");
- }
-
- @Test
- public void testSaslMechanismCreation()
- {
- setupMocks();
-
- final SaslSettings saslSettings = mock(SaslSettings.class);
- final SaslNegotiator saslNegotiator = _manager.createSaslNegotiator(MOCK_MECH_NAME, saslSettings, null);
- assertNotNull(saslNegotiator);
- }
-
- /**
- * Tests that the authenticate method correctly interprets an
- * authentication success.
- */
- @Test
- public void testSaslAuthenticationSuccess()
- {
- setupMocks();
- final UsernamePrincipal expectedPrincipal = new UsernamePrincipal("guest", _manager);
-
- when(_saslNegotiator.handleResponse(any(byte[].class))).thenReturn(new AuthenticationResult(expectedPrincipal));
-
- final AuthenticationResult result = _saslNegotiator.handleResponse("12345".getBytes());
- assertOnlyContainsWrapped(expectedPrincipal, result.getPrincipals());
- assertEquals(AuthenticationStatus.SUCCESS, result.getStatus());
- }
-
- /**
- * Tests that the authenticate method correctly interprets an
- * authentication not complete.
- */
- @Test
- public void testSaslAuthenticationNotCompleted()
- {
- setupMocks();
- when(_saslNegotiator.handleResponse(any(byte[].class))).thenReturn(new AuthenticationResult(AuthenticationStatus.CONTINUE));
-
- final AuthenticationResult result = _saslNegotiator.handleResponse("12345".getBytes());
- assertEquals(0, (long) result.getPrincipals().size(), "Principals was not expected size");
- assertEquals(AuthenticationStatus.CONTINUE, result.getStatus());
- }
-
- /**
- * Tests that the authenticate method correctly interprets an
- * authentication error.
- */
- @Test
- public void testSaslAuthenticationError()
- {
- setupMocks();
- when(_saslNegotiator.handleResponse(any(byte[].class))).thenReturn(new AuthenticationResult(AuthenticationStatus.ERROR));
-
- final AuthenticationResult result = _saslNegotiator.handleResponse("12345".getBytes());
- assertEquals(0, (long) result.getPrincipals().size(), "Principals was not expected size");
- assertEquals(AuthenticationStatus.ERROR, result.getStatus());
- }
-
- @Test
- public void testNonSaslAuthenticationSuccess() throws Exception
- {
- setupMocks();
- when(_principalDatabase.verifyPassword("guest", "guest".toCharArray())).thenReturn(true);
-
- final AuthenticationResult result = _manager.authenticate("guest", "guest");
- final UsernamePrincipal expectedPrincipal = new UsernamePrincipal("guest", _manager);
- assertOnlyContainsWrapped(expectedPrincipal, result.getPrincipals());
- assertEquals(AuthenticationStatus.SUCCESS, result.getStatus());
- }
-
- @Test
- public void testNonSaslAuthenticationErrored() throws Exception
- {
- setupMocks();
- when(_principalDatabase.verifyPassword("guest", "wrongpassword".toCharArray())).thenReturn(false);
-
- final AuthenticationResult result = _manager.authenticate("guest", "wrongpassword");
- assertEquals(0, (long) result.getPrincipals().size(), "Principals was not expected size");
- assertEquals(AuthenticationStatus.ERROR, result.getStatus());
- }
-
- @Test
- public void testOnCreate()
- {
- setupMocks();
- assertTrue(new File(_passwordFileLocation).exists(), "Password file was not created");
- }
-
- @Test
- public void testOnDelete()
- {
- setupMocks();
- assertTrue(new File(_passwordFileLocation).exists(), "Password file was not created");
-
- _manager.delete();
- assertFalse(new File(_passwordFileLocation).exists(), "Password file was not deleted");
- }
-
- @Test
- public void testCreateForInvalidPath()
- {
- setUpPrincipalDatabase();
-
- final String path = TMP_FOLDER + File.separator + getTestName() + System.nanoTime() + File.separator + "users";
- final Map<String,Object> attrs = Map.of(ConfiguredObject.ID, randomUUID(),
- ConfiguredObject.NAME, getTestName(),
- "path", path);
-
- _manager = getPrincipalDatabaseAuthenticationManager(attrs);
-
- final IllegalConfigurationException thrown = assertThrows(IllegalConfigurationException.class,
- () -> _manager.create(), "Creation with invalid path should have failed");
- assertEquals(String.format("Cannot create password file at '%s'", path), thrown.getMessage(),
- "Unexpected exception message:" + thrown.getMessage());
- }
-
- @SuppressWarnings({"rawtypes", "unchecked"})
- final PrincipalDatabaseAuthenticationManager<?> getPrincipalDatabaseAuthenticationManager(final Map<String, Object> attrs)
- {
- return new PrincipalDatabaseAuthenticationManager(attrs, BrokerTestHelper.createNewBrokerMock())
- {
- @Override
- protected PrincipalDatabase createDatabase()
- {
- return _principalDatabase;
- }
- };
- }
-
- private void deletePasswordFileIfExists()
- {
- final File passwordFile = new File(_passwordFileLocation);
- if (passwordFile.exists())
- {
- passwordFile.delete();
- }
- }
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/sasl/crammd5/CramMd5NegotiatorTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/sasl/crammd5/CramMd5NegotiatorTest.java
index 9c7cf16668..3dfc6d55f1 100644
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/sasl/crammd5/CramMd5NegotiatorTest.java
+++ b/broker-core/src/test/java/org/apache/qpid/server/security/auth/sasl/crammd5/CramMd5NegotiatorTest.java
@@ -33,13 +33,13 @@ import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
+import org.apache.qpid.server.util.ServerScopedRuntimeException;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider;
import org.apache.qpid.server.security.auth.AuthenticationResult;
-import org.apache.qpid.server.security.auth.database.HashedUser;
import org.apache.qpid.server.security.auth.sasl.PasswordSource;
import org.apache.qpid.server.security.auth.sasl.SaslUtil;
import org.apache.qpid.test.utils.UnitTestBase;
@@ -288,8 +288,7 @@ public class CramMd5NegotiatorTest extends UnitTestBase
private void hashPassword()
{
- final HashedUser hashedUser = new HashedUser(VALID_USERNAME, VALID_USERPASSWORD, _authenticationProvider);
- final char[] password = hashedUser.getPassword();
+ final char[] password = hashPassword(VALID_USERPASSWORD);
when(_passwordSource.getPassword(eq(VALID_USERNAME))).thenReturn(password);
}
@@ -301,4 +300,45 @@ public class CramMd5NegotiatorTest extends UnitTestBase
final char[] password = Base64.getEncoder().encodeToString(md.digest()).toCharArray();
when(_passwordSource.getPassword(eq(VALID_USERNAME))).thenReturn(password);
}
+
+ private char[] hashPassword(char[] password)
+ {
+ byte[] byteArray = new byte[password.length];
+ int index = 0;
+ for (char c : password)
+ {
+ byteArray[index++] = (byte) c;
+ }
+
+ byte[] md5ByteArray = getMD5(byteArray);
+
+ char[] result = new char[md5ByteArray.length];
+
+ index = 0;
+ for (byte c : md5ByteArray)
+ {
+ result[index++] = (char) c;
+ }
+ return result;
+ }
+
+ private byte[] getMD5(byte[] data)
+ {
+ MessageDigest md = null;
+ try
+ {
+ md = MessageDigest.getInstance("MD5");
+ }
+ catch (NoSuchAlgorithmException e)
+ {
+ throw new ServerScopedRuntimeException("MD5 not supported although Java compliance requires it");
+ }
+
+ for (byte b : data)
+ {
+ md.update(b);
+ }
+
+ return md.digest();
+ }
}
diff --git a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/add.js b/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/add.js
deleted file mode 100644
index 52ed46d28c..0000000000
--- a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/add.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-define(["dojo/query", "dijit/registry", "qpid/common/util"], function (query, registry, util)
-{
- return {
- show: function (data)
- {
- util.parseHtmlIntoDiv(data.containerNode, "authenticationprovider/filebased/add.html", function ()
- {
- if (!!data.data)
- {
- util.applyToWidgets(data.containerNode,
- "AuthenticationProvider",
- "Base64MD5PasswordFile",
- data.data,
- data.metadata);
- }
-
- var pathWidget = registry.byNode(query(".path", data.containerNode)[0]);
- pathWidget.set("disabled", !!(data.data && data.data.id));
- pathWidget.set("value", data.data ? data.data.path : "");
- });
- }
- };
-});
-
diff --git a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/show.js b/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/show.js
deleted file mode 100644
index 650e780a68..0000000000
--- a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/base64md5passwordfile/show.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-define(["qpid/common/util", "dojo/domReady!"], function (util)
-{
-
- function Base64MD5PasswordFile(data)
- {
- util.buildUI(data.containerNode, data.parent, "authenticationprovider/filebased/show.html", ["path"], this);
- }
-
- Base64MD5PasswordFile.prototype.update = function (data)
- {
- util.updateUI(data, ["path"], this);
- }
-
- return Base64MD5PasswordFile;
-});
diff --git a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/add.js b/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/add.js
deleted file mode 100644
index 0f0e77faf0..0000000000
--- a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/add.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-define(["dojo/query", "dijit/registry", "qpid/common/util"], function (query, registry, util)
-{
- return {
- show: function (data)
- {
- util.parseHtmlIntoDiv(data.containerNode, "authenticationprovider/filebased/add.html", function ()
- {
- if (!!data.data)
- {
- util.applyToWidgets(data.containerNode,
- "AuthenticationProvider",
- "PlainPasswordFile",
- data.data,
- data.metadata);
- }
-
- var pathWidget = registry.byNode(query(".path", data.containerNode)[0]);
- pathWidget.set("disabled", !!(data.data && data.data.id));
- pathWidget.set("value", data.data ? data.data.path : "");
-
- });
- }
- };
-});
-
diff --git a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/show.js b/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/show.js
deleted file mode 100644
index e717889651..0000000000
--- a/broker-plugins/management-http/src/main/java/resources/js/qpid/management/authenticationprovider/plainpasswordfile/show.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-define(["qpid/common/util", "dojo/domReady!"], function (util)
-{
-
- function PlainPasswordFile(data)
- {
- util.buildUI(data.containerNode, data.parent, "authenticationprovider/filebased/show.html", ["path"], this);
- }
-
- PlainPasswordFile.prototype.update = function (data)
- {
- util.updateUI(data, ["path"], this);
- }
-
- return PlainPasswordFile;
-});
diff --git a/doc/java-broker/src/docbkx/Java-Broker-Initial-Configuration.xml b/doc/java-broker/src/docbkx/Java-Broker-Initial-Configuration.xml
index 981838f88b..89ffb63e25 100644
--- a/doc/java-broker/src/docbkx/Java-Broker-Initial-Configuration.xml
+++ b/doc/java-broker/src/docbkx/Java-Broker-Initial-Configuration.xml
@@ -361,8 +361,7 @@ $ ./qpid-server -prop "qpid.amqp_port=10000" -prop "qpid.http_port=10001"
</programlisting>
<para>In the configuration above the following entries are stored: <itemizedlist>
<listitem>
- <para> Authentication Provider of type
- <emphasis>PlainPasswordFile</emphasis> with name "passwordFile".
+ <para> Authentication Provider of type <emphasis>Plain</emphasis> with name "Plain".
</para>
</listitem>
<listitem>
diff --git a/doc/java-broker/src/docbkx/management/managing/Java-Broker-Management-Managing-Authentication-Providers.xml b/doc/java-broker/src/docbkx/management/managing/Java-Broker-Management-Managing-Authentication-Providers.xml
index 95477fcad2..47e289686f 100644
--- a/doc/java-broker/src/docbkx/management/managing/Java-Broker-Management-Managing-Authentication-Providers.xml
+++ b/doc/java-broker/src/docbkx/management/managing/Java-Broker-Management-Managing-Authentication-Providers.xml
@@ -46,12 +46,8 @@
local database</para></listitem>
<listitem><para><link linkend="Java-Broker-Security-Plain-Provider">Plain</link>: authenticate users against credentials stored in a local
database.</para></listitem>
- <listitem><para><link linkend="Java-Broker-Security-PlainPasswordFile-Provider">PlainPasswordFile</link>: authenticate users against credentials stored
- in plain text in a local file.</para></listitem>
<listitem><para><link linkend="Java-Broker-Security-MD5-Provider">MD5</link>: authenticate users against credentials
stored in a local database.</para></listitem>
- <listitem><para><link linkend="Java-Broker-Security-Base64MD5PasswordFile-Provider">Base64MD5PasswordFile</link>: authenticate users against credentials
- stored encoded in a local file.</para></listitem>
</itemizedlist>
</para>
<para>The last five providers offer user management facilities too, that is, users can
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Base64MD5PasswordFile.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Base64MD5PasswordFile.xml
deleted file mode 100644
index d298d5b860..0000000000
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Base64MD5PasswordFile.xml
+++ /dev/null
@@ -1,42 +0,0 @@
-<?xml version="1.0"?>
-<!--
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-
--->
-
-<section xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="Java-Broker-Security-Base64MD5PasswordFile-Provider">
- <title>Base64MD5 Password File <emphasis>(Deprecated)</emphasis></title>
- <para><emphasis>This provider is deprecated and will be removed in a future release. The
- <link linkend="Java-Broker-Security-MD5-Provider">MD5</link> provider should be used
- instead.</emphasis></para>
- <para> Base64MD5PasswordFile Provider uses local file to store and manage user credentials
- similar to PlainPasswordFile but instead of storing a password the MD5 password digest encoded
- with Base64 encoding is stored in the file. When creating an authentication provider the path
- to the file needs to be specified. If specified file does not exist an empty file is created
- automatically on Authentication Provider creation. On Base64MD5PasswordFile Provider deletion
- the password file is deleted as well.</para>
- <para>For this provider user credentials can be added, removed or changed using
- Management.</para>
- <section>
- <title>Base64MD5 File Format</title>
- <para> The user credentials are stored on the single file line as user name and user password
- pairs separated by colon character. The password is stored MD5 digest/Base64 encoded. This
- file must not be modified externally whilst the Broker is running.</para>
- </section>
-</section>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5.xml
index 4bb13d9674..d95241a4a4 100644
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5.xml
+++ b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5.xml
@@ -23,10 +23,9 @@
<section xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="Java-Broker-Security-MD5-Provider">
<title>MD5 Provider</title>
- <para> MD5 Provider uses the Broker configuration itself to store the database of
- users (unlike the <link linkend="Java-Broker-Security-Base64MD5PasswordFile-Provider">Base64MD5 Password File</link>, there is no separate password file). Rather than store the
- unencrypted user password (as the Plain provider does) it instead stores the MD5 password
- digest. This can be further encrypted using the
+ <para> MD5 Provider uses the Broker configuration itself to store the database of users. Rather than store the
+ unencrypted user password (as the Plain provider does) it instead stores the MD5 password digest.
+ This can be further encrypted using the
facilities described in <xref linkend="Java-Broker-Security-Configuration-Encryption"/>.</para>
<para>For this provider user credentials can be added, removed or changed using
Management.</para>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5PasswordFile.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5PasswordFile.xml
deleted file mode 100644
index efafcadddc..0000000000
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-MD5PasswordFile.xml
+++ /dev/null
@@ -1,41 +0,0 @@
-<?xml version="1.0"?>
-<!--
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-
--->
-
-<section xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="Java-Broker-Security-Base64MD5PasswordFile-Provider">
- <title>Base64MD5 Password File <emphasis>(Deprecated)</emphasis></title>
- <para><emphasis>This provider is deprecated and will be removed in a future release. The <link linkend="Java-Broker-Security-MD5-Provider">MD5</link> provider should be used
- instead.</emphasis></para>
- <para> Base64MD5PasswordFile Provider uses local file to store and manage user credentials
- similar to PlainPasswordFile but instead of storing a password the MD5 password digest
- encoded with Base64 encoding is stored in the file. When creating an authentication provider
- the path to the file needs to be specified. If specified file does not exist an empty file
- is created automatically on Authentication Provider creation. On Base64MD5PasswordFile
- Provider deletion the password file is deleted as well.</para>
- <para>For this provider user credentials can be added, removed or changed using
- Management.</para>
- <section>
- <title>Base64MD5 File Format</title>
- <para> The user credentials are stored on the single file line as user name and user
- password pairs separated by colon character. The password is stored MD5 digest/Base64
- encoded. This file must not be modified externally whilst the Broker is running.</para>
- </section>
-</section>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Plain.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Plain.xml
index c64731c153..ff96a7ee5a 100644
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Plain.xml
+++ b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-Plain.xml
@@ -22,8 +22,7 @@
<section xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="Java-Broker-Security-Plain-Provider">
<title>Plain</title>
- <para>The Plain Provider uses the Broker configuration itself to store the database of users
- (unlike the <link linkend="Java-Broker-Security-PlainPasswordFile-Provider">PlainPasswordFile</link>, there is no separate password file). As the name suggests,
+ <para>The Plain Provider uses the Broker configuration itself to store the database of users. As the name suggests,
the user data (including password) is not hashed in any way. In order to provide encryption,
the facilities described in <xref linkend="Java-Broker-Security-Configuration-Encryption"/>
must be used.</para>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-PlainPasswordFile.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-PlainPasswordFile.xml
deleted file mode 100644
index dcce64a573..0000000000
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers-PlainPasswordFile.xml
+++ /dev/null
@@ -1,45 +0,0 @@
-<?xml version="1.0"?>
-<!--
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-
--->
-
-<section xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="Java-Broker-Security-PlainPasswordFile-Provider">
- <title>Plain Password File <emphasis>(Deprecated)</emphasis></title>
- <para><emphasis>This provider is deprecated and will be removed in a future release. The <link linkend="Java-Broker-Security-Plain-Provider">Plain</link> provider should be used
- instead.</emphasis></para>
- <para> The PlainPasswordFile Provider uses local file to store and manage user credentials. When
- creating an authentication provider the path to the file needs to be specified. If specified
- file does not exist an empty file is created automatically on Authentication Provider
- creation. On Provider deletion the password file is deleted as well.</para>
- <para>For this provider user credentials can be added, removed or changed using
- Management.</para>
-
- <section>
- <title>Plain Password File Format</title>
- <para> The user credentials are stored on the single file line as user name and user
- password pairs separated by colon character. This file must not be modified externally
- whilst the Broker is running.</para>
- <programlisting>
-# password file format
-# <user name>: <user password>
-guest:guest
- </programlisting>
- </section>
-</section>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers.xml
index 3ca0e2c8c9..ff12aa6184 100644
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers.xml
+++ b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Authentication-Providers.xml
@@ -60,8 +60,6 @@
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-Anonymous.xml"/>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-ScramSha.xml"/>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-Plain.xml"/>
- <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-PlainPasswordFile.xml"/>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-MD5.xml"/>
- <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-Base64MD5PasswordFile.xml"/>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="Java-Broker-Security-Authentication-Providers-Composite.xml"/>
</section>
diff --git a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Configuration-Encryption.xml b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Configuration-Encryption.xml
index 2f9cf51484..6b01ae0aa9 100644
--- a/doc/java-broker/src/docbkx/security/Java-Broker-Security-Configuration-Encryption.xml
+++ b/doc/java-broker/src/docbkx/security/Java-Broker-Security-Configuration-Encryption.xml
@@ -42,11 +42,6 @@
enabled/disabled via the <link linkend="Java-Broker-Management-Managing-Broker">Broker attributes</link>
within the Web Management Console. On enabling the provider, any existing passwords within the
configuration will be automatically rewritten in the encrypted form.</para>
- <para>Note that passwords stored by the Authentication Providers <link linkend="Java-Broker-Security-PlainPasswordFile-Provider">PlainPasswordFile</link> and.
- <link linkend="Java-Broker-Security-Base64MD5PasswordFile-Provider">PlainPasswordFile</link>
- with the external password files are <emphasis>not</emphasis> encrypted by the key. Use the
- Scram Authentication Managers instead; these make use of the Configuration Encryption when
- storing the users' passwords. </para>
</section>
<section xml:id="Java-Broker-Security-Configuration-Encryption-Alternate-Implementations">
<title>Alternate Implementations</title>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org